System, method and program for detecting anomalous events in a utility network

ABSTRACT

A communication device detects whether anomalous events occur with respect to at least one node in a utility network. The communication device has recorded therein threshold operating information and situational operating information. The threshold operating information includes data indicative of configured acceptable operating parameters of nodes in the network based on respective locational information of the nodes. The situational information includes data indicative of configured operation data expected to be received from nodes in the network during a predetermined time period, based on a condition and/or event occurring during the time period. The communication device receives operation data from nodes in the network, and determines whether the operation data from a node constitutes an anomalous event based on a comparison of the received operation data with (i) the threshold operating information defined for the node and (ii) the situational information. The communication device outputs notification of any determined anomalous event.

RELATED APPLICATION

This application is a continuation of U.S. application Ser. No.12/851,830, filed Aug. 6, 2010, the entire content of which is herebyincorporated by reference in its entirety.

FIELD OF THE DISCLOSURE

The present disclosure relates generally to a system, device, method andcomputer program for detecting anomalous events in the operation of autility network.

BACKGROUND

Automated Meter Reading (AMR) systems, including handheld, mobile andnetwork technologies for automatically collecting data from utilitymeters, efficiently and accurately collect metering data, as compared tomanual meter reading. Advanced Metering Infrastructure (AMI) networksemploying AMR technology collect additional types of data, such asinterval data or logging of meter events. The additional data is usedfor a variety of purposes, e.g., usage profiling, time of use billing,demand forecasting, demand response, rate of flow recording, leakdetection, flow monitoring, conservation enforcement, and remoteshutoff.

In an AMR/AMI network, the utility meters are fully electronic with datareading, data storing, and digital packet communications capabilities.The utility meters are all linked together in a wireless LAN (local areanetwork) configuration. In this configuration, each utility meter is anetwork node. Each node can communicate with other nodes directly andwith a communication station of the utility provider via an accesspoint. Some nodes may be able to communicate with more than one accesspoint. The access points act as a gateway for the nodes in the wirelessnetwork, and transfer messages between themselves, other nodes and thecommunication station of the utility provider. Similarly, thecommunication station of the utility provider can communicate with thenodes in the wireless LAN via the access points. Access points can bepassive bridges or active data routers/forwarders, depending on the typeof network devices deployed and the applications. An example of anAMR/AMI network and a technique of connecting nodes thereto is found inU.S. application Ser. No. 11/732,964, now U.S. Pat. No. 7,962,101, whichis incorporated herein by reference in its entirety.

The introduction of an AMR/AMI network has facilitated communicationsbetween utility meters and a communication station of a utilityprovider, particularly with collecting usage data at the meters andreporting the collected usage data to the communication station of theutility provider. In addition, an AMR/AMI network can facilitateimplementation of network management at the communication station of theutility provider, such as monitoring distribution of a commodity acrossthe utility network, load detection and management at nodes in theutility network, and remote connection and disconnection. Anomalousevents can occur in connection with the operation of the utilitynetwork. The anomalous events can be intentionally created by a utilityconsumer, such as by manipulating the operation of a utility meter, oroccur accidentally, such as in connection with a power outage over aportion of the utility network. Detecting anomalous events in theutility network contemporaneously with the occurrence of such events canfacilitate improved management and operation of the utility network.

SUMMARY

An exemplary embodiment provides a utility network communication deviceconfigured to detect anomalous events occurring in connection with atleast one node in a utility network. The exemplary communication deviceincludes a memory unit having threshold operating information andsituational information defined and recorded therein. The thresholdoperating information includes data indicative of configured acceptableoperating parameters of nodes in the utility network based on respectivelocational information of the nodes in the utility network. Thesituational information includes data indicative of configured operationdata expected to be received from nodes in the utility network during apredetermined time period based on at least one of a condition and anevent that is occurring during the predetermined time period. Theexemplary communication device also includes a communication unitconfigured to receive operation data from nodes in the utility network,and a control unit. The control unit is configured to compare theoperation data received from a node in the utility network with (i) thethreshold operating information defined for the node from which theoperation data was received and (ii) the situational information, and todetermine whether the operation data received from the node constitutesan anomalous event based on the comparison of the received operationdata with (i) the threshold operating information defined for the nodeand (ii) the situational information. The exemplary communication devicealso includes a notification unit configured to output notification ofthe determined anomalous event.

An exemplary embodiment provides a method of operating a utility networkcommunication device to detect anomalous events occurring in connectionwith at least one node in a utility network. The exemplary methodincludes defining, in the communication device, threshold operatinginformation for nodes in the utility network. The threshold operatinginformation includes configured acceptable operating parameters of thenodes in the utility network based on respective locational informationof the nodes in the utility network. The exemplary method also includesdefining, in the communication device, situational information for thenodes in the utility network. The situational information includes dataindicative of configured operation data expected to be received fromnodes in the utility network during a predetermined time period, basedon at least one of a condition and an event occurring during thepredetermined time period. The exemplary method also includes recordingthe defined threshold operating information and situational informationin a memory unit of the communication device, and receiving operationdata from at least one node in the utility network. In addition, theexemplary method includes comparing, in a processing unit of thecommunication device, the received operation data with the thresholdoperating information and the situational information which arerespectively defined for the at least one node from which the operatingdata was received. The exemplary method also includes determining, in aprocessing unit of the communication device, whether the receivedoperation data constitutes an anomalous event based on the comparison ofthe received operation data with (i) the threshold operating informationand (ii) the situational information. Furthermore, the exemplary methodincludes outputting, from a notification unit of the communicationdevice, notification of a determined anomalous event.

An exemplary embodiment provides a computer-readable recording mediumhaving a computer program recorded thereon that causes a control unit ofa utility network communication device communicatively connected to thecomputer-readable recording medium to detect anomalous events occurringin connection with at least one node in a utility network. The programcauses the control unit of the communication device to execute anoperation of defining threshold operating information for nodes in theutility network, where the threshold operating information includes dataindicative of configured acceptable operating parameters of the nodes inthe utility network based on respective locational information of thenodes in the utility network. The program also causes the control unitof the communication device to perform an operation of definingsituational information for the nodes in the utility network, where thesituational information includes data indicative of configured operationdata expected to be received from nodes in the utility network during apredetermined time period based on at least one of a condition and anevent that is occurring during the predetermined time period. Inaddition, the program causes the control unit of the communicationdevice to perform operations of recording the defined thresholdoperating information and situational information in a memory unit ofthe communication device, and receiving operation data from at least onenode in the utility network. Furthermore, the program causes the controlunit of the communication device to perform operations of comparing thereceived operation data with (i) the threshold operating information and(ii) the situational information which are respectively defined for theat least one node from which the operating data was received, anddetermining whether the received operation data constitutes an anomalousevent based on the comparison of the received operation data with (i)the threshold operating information and (ii) the situationalinformation. In addition, the program also causes the control unit ofthe communication device to perform an operation of outputtingnotification of a determined anomalous event.

An exemplary embodiment provides a node in a utility network. Theexemplary node in the utility network includes a network interfaceconfigured to enable the node to communicate with at least one othernode in the utility network, and a control unit configured to detectanomalous events occurring in connection with the node in the utilitynetwork. The exemplary node in the utility network also includes amemory unit having defined and recorded therein threshold operatinginformation including data indicative of configured acceptable operatingparameters of the node during a predetermined time period. The thresholdoperating information recorded in the memory unit includes a thresholdvalue indicating a maximum number of times that the network interfacetransmits a communication failure message to a first other node in theutility network attempting to communicate with the node during thepredetermined time period. The control unit is also configured to adjusta value of a counter each time that the network interface transmits acommunication failure message to the first other node, and generateoperation data representing the adjusted value of the counter. Inaddition, the control unit is configured to compare the value of thecounter represented in the generated operation data with the thresholdvalue included in the threshold operating information recorded in thememory unit, and determine that an anomalous event has occurred when thethreshold value included in the recorded threshold operating informationhas been reached, based on the comparison of the value of the counterwith the threshold value included in the threshold operatinginformation. The control unit is also configured to generate anotification signal indicating the determination of the anomalous event.The exemplary node in the utility network also includes a notificationunit configured to transmit the notification signal generated by thecontrol unit to a second other node in the utility network distinct fromthe first other node in the utility network.

An exemplary embodiment provides a node in a utility network. Theexemplary node in the utility network includes a network interfaceconfigured to enable the node to communicate with at least one othernode in the utility network, and a control unit configured to detectanomalous events occurring in connection with the node in the utilitynetwork. The exemplary node in the utility network also includes amemory unit having defined and recorded therein threshold operatinginformation including data indicative of configured acceptable operatingparameters of the node during a predetermined time period. The thresholdoperating information recorded in the memory unit includes a thresholdvalue indicating a maximum number of times that the network interfacereceives a communication from a first other node in the utility networkattempting to communicate with the node during the predetermined timeperiod. The control unit is configured to adjust a value of a countereach time that the network interface receives a communication from thefirst other node, and generate operation data representing the adjustedvalue of the counter. In addition, the control unit is configured tocompare the value of the counter represented in the generated operationdata with the threshold value included in the threshold operatinginformation recorded in the memory unit, and determine that an anomalousevent has occurred when the threshold value included in the recordedthreshold operating information has been reached, based on thecomparison of the value of the counter with the threshold value includedin the threshold operating information. The control unit is alsoconfigured to generate a notification signal indicating thedetermination of the anomalous event. The exemplary node in the utilitynetwork also includes a notification unit configured to transmit thenotification signal generated by the control unit to a second other nodein the utility network distinct from the first other node in the utilitynetwork.

An exemplary embodiment provides a node in a utility network. Theexemplary node in the utility network includes a network interfaceconfigured to enable the utility meter to communicate with at least oneother node in the utility network, and a control unit configured todetect anomalous events occurring in connection with the node in theutility network. In addition, the exemplary node in the utility networkincludes a memory unit having defined and recorded therein (i) a routingtable including each downstream node which has registered with the nodein the utility network to forward respective communications from thedownstream nodes to another node constituting an upstream node of thenode in the utility network, and (ii) threshold operating informationincluding a threshold value indicating a number of the downstream nodesregistered in the routing table which transmit an un-registrationmessage to the network interface during a predetermined time period. Thecontrol unit is configured to adjust a value of a counter each time thatthe network interface receives an un-registration message from adownstream node registered in the routing table recorded in the memoryunit, and generate operation data representing the adjusted value of thecounter. The control unit is also configured to compare the value of thecounter represented in the generated operation data with the thresholdvalue included in the threshold operating information recorded in thememory unit, and determine that an anomalous event has occurred when thethreshold value included in the recorded threshold operating informationhas been reached, based on the comparison of the value of the counterwith the threshold value included in the threshold operatinginformation. In addition, the control unit is configured to generate anotification signal indicating the determination of the anomalous event.The exemplary node in the utility network also includes a notificationunit configured to transmit the notification signal generated by thecontrol unit to the upstream node of the utility network.

An exemplary embodiment provides a node in a utility network. Theexemplary node in the utility network includes a network interfaceconfigured to enable the node to communicate with at least one othernode in the utility network, and a control unit configured to detectanomalous events occurring in connection with the node in the utilitynetwork. The exemplary node in the utility network also includes amemory unit having defined and recorded therein threshold operatinginformation including data indicative of configured acceptable operatingparameters of the node in the utility network during a predeterminedtime period. The threshold operating information recorded in the memoryunit includes a threshold value indicating a maximum value of acommodity expected to be consumed at a premises at which the node islocated during the predetermined time period. The control unit isconfigured to monitor a value of consumption of the commodity atpredetermined increments of the predetermined time period, and generateoperation data representing the monitored consumption value. The controlunit is also configured to compare the consumption value represented inthe generated operation data with the threshold value included in thethreshold operating information recorded in the memory unit, anddetermine that an anomalous event has occurred when the consumptionvalue represented in the generated operation data is greater than orequal to the threshold value included in the threshold operatinginformation recorded in the memory unit. In addition, the control unitis configured to generate a notification signal indicating thedetermination of the anomalous event. The exemplary node in the utilitynetwork also includes a notification unit configured to transmit thenotification signal to another node in the utility network with whichthe node in the utility network is authorized to communicate.

BRIEF DESCRIPTION OF THE DRAWINGS

Other objects, refinements and advantages of the present disclosure willbecome apparent to those skilled in the art upon reading the followingdetailed description of exemplary embodiments, in conjunction with theaccompanying drawings, in which like reference numerals have been usedto designate like elements, and in which:

FIG. 1 is a block diagram of an exemplary configuration of an AMR/AMInetwork in which features of the present disclosure can be implemented;

FIG. 2 is a block diagram of an exemplary configuration of a utilitynetwork interface device according to at least one embodiment;

FIG. 3 is a block diagram of an exemplary configuration of acommunication station of a utility provider according to at least oneembodiment;

FIG. 4 is an explanatory diagram illustrating exemplary operationsperformed by a control unit of the communication station in detectingwhether an anomalous event has occurred in connection with one or morenodes in the utility network;

FIGS. 5A-5C respectively illustrate three exemplary embodiments of theconfiguration of the control unit of the communication station indetecting whether an anomalous event has occurred with respect to a nodebased on a comparison of operation data received from the node withthreshold operating information and situational information defined andrecorded for the node in a memory unit of the communication station;

FIG. 6 illustrates an example of an electrical distribution networkoperating in conjunction with a utility network, in which features ofthe present disclosure can be implemented;

FIG. 7 is a flowchart diagram illustrating an exemplary method ofoperating a communication station of a utility provider to detectwhether anomalous events occur in connection with one or more nodes inthe utility network; and

FIG. 8 is a flowchart diagram illustrating an exemplary method ofoperating a utility network interface device to detect whether anomalousevents occur in connection with the utility network interface deviceand/or another node in a utility network.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

I. Exemplary Network

FIG. 1 is a network diagram illustrating an exemplary configuration ofan AMR/AMI network 100 in which features of the present disclosure canbe implemented. FIG. 1 illustrates the AMR/AMI network 100 in the formof a mesh network, as an example of the type of network in which thepresent disclosure can be implemented. The present disclosure can beimplemented in other types of networks. For example, the AMR/AMI network100 can be a star network in which a plurality of nodes communicateaccording to predetermined communication paths with a central node, suchas a communication station of a utility provider.

In the exemplary network configuration illustrated in FIG. 1, thenetwork 100 employs one or more access points 110, e.g., gateways, thatare connected to a communication station 120 of a utility provider. Theconnections between the access point(s) 110 and the communicationstation 120 may be provided by a wide area network (WAN), a virtualprivate network (VPN), or other suitable configuration, through wiredand/or wireless communication mediums. The communication medium betweenan access point 110 and the communication station 120 is referred to asa backhaul. An access point 110 can have a different backhaul connectionto the communication station 120 than another access point 110. Forexample, in the exemplary network 100 illustrated in FIG. 1, the accesspoint 110 on the left hand side of the drawing can have a backhaulconstituted by a WAN, the access point 110 in the middle of the drawingcan have a backhaul constituted by fiber optic cables, and the accesspoint 110 on the right hand side of the drawing can have a backhaulconstituted by a VPN over a public network such as the Internet.

Each access point 110 can also connect directly or indirectly with oneor more utility meters 130 via a wireless local area network (LAN), forexample. The utility meters 130 can communicate with each other and withthe access points 110 via the wireless LAN, to continuously keep trackof preferred pathways for connection to one or more of the access points110. The access points 110 constitute an interface between thecommunication station 120 and one or more utility meters 130 and/orrelays 140.

It is also conceived that a meter 130 may communicate directly with thecommunication station 120 of the utility provider if an access point 110is not within a predetermined proximity of the meter 130. Alternatively,the meter 130 may communicate directly with the communication station120 if the quality of communication between the meter 130 and thecommunication station 120 exceeds the quality of communication betweenthe meter 130 and an access point 110, or exceeds the quality ofcommunication between the access point 110 and the communication station120. According to an exemplary embodiment, relay stations 140 may alsobe provided in the network 100 as repeater stations between meters 130and one or more of the access points 110 or communication station 120.

According to exemplary embodiments as provided herein, the utilitymeters 130 are enabled to communicate with each other and other accesspoints 110 and relay stations 140 of the network 100 by being equippedwith a utility network interface device. An example of a utility networkinterface device is a network interface card (NIC), which will bedescribed in further detail herein. It will be appreciated by thoseskilled in the art that the operative functions performed by the meter130, as described herein, can be performed by the utility networkinterface device (e.g., NIC) associated with the meter 130. The NIC canbe associated with the meter 130 by being integrated in, physicallyattached to, and/or electrically connected to the meter 130.Accordingly, as used herein, any reference to a utility meter 130 isintended to encompass a utility meter 130 having a utility networkinterface device associated with the utility meter 130, or a utilitymeter 130 that includes constituent components corresponding to thestructural features of a utility network interface device as describedherein and/or constituent components that can perform the operativefunctions of a utility network interface device as described herein.

In the exemplary utility network 100 illustrated in FIG. 1, the accesspoints 110, the communication station 120, meters 130 and relays 140 areexamples of nodes in the network 100. The term “node,” as used herein,connotes a device having communicative functions in the network 100.

The addition or subtraction of meters 130, as nodes in the network 100,is dynamically accommodated in the network 100. Examples of techniquesfor connecting and/or disconnecting meters to/from an AMR/AMI network ofa utility provider and establishing communication protocols between thenodes in the network are disclosed in U.S. application Ser. Nos.11/732,964 and 12/139,413, now U.S. Pat. Nos. 7,692,101 and 7,889,094,respectively, the entire contents of which are hereby incorporated byreference. An example of a technique for establishing security protocolsfor added and/or disconnected nodes in an AMR/AMI network such as thenetwork 100 illustrated in FIG. 1 is disclosed in co-pending U.S.application Ser. No. 12/187,354, the entire contents of which are herebyincorporated by reference.

II. Exemplary Utility Network Interface Device

FIG. 2 is a block diagram illustrating an exemplary configuration of autility network interface device configured to operate in conjunctionwith a utility meter 130, such as gas, electric and water meters, forexample. To enable the utility meters 130 to communicate with thevarious nodes (e.g., access points 110, communication station 120, otherutility meters 130, relays 140, etc.) in the network 100, utility meters130 of the AMR/AMI network 100 are provided with a utility networkinterface device. As discussed above, a NIC is an example of a utilitynetwork interface device. A NIC 2 is a module that can be attached to orincorporated within a utility meter 130 to constitute the utilitynetwork interface device of the utility meter 130. According to anexemplary embodiment, the NIC 2 may be constituted by a single printedcircuit board. FIG. 2 illustrates an exemplary configuration of a NIC 2in which the structural components of the NIC 2 are mounted on a singleprinted circuit board.

As illustrated in FIG. 2, the NIC 2 may include an AC power adapter 3and a power supply 4. The AC power adapter 3 connects an external powersource to the power supply 4 to provide an input voltage to the powersupply 4. The external power source may constitute a power source in theutility meter 130 to which the NIC 2 is attached, and/or a power sourceexternal to the utility meter 130. The power supply 4 converts the inputvoltage to various output voltages for the various powered components ofthe NIC 2. Alternatively or as a backup, the input voltage for the powersupply 4 can be provided by a battery provided on the NIC 2. Forexample, in the event that the AC power adapter 3 connects an externalpower source (e.g., a load terminal at an electric meter) to the powersupply 4 to normally power the NIC 2, the battery power supply can beused to power the NIC 2 in the event of a power outage.

An Application-Specific Integrated Circuit (ASIC) 5 of the NIC 2 isencoded to control the components of the NIC 2 via a Central ProcessingUnit (CPU) 6 and a memory 7. The CPU 6 can be an ARM processor, forexample. The CPU 6 is configured to control the operations of the NIC 2.The CPU 6 can include, for example, a processor for controlling theaggregate operations of the NIC 2, a non-volatile memory, such as aread-only memory (ROM) and/or flash memory, for example, that storesprograms, such as firmware, application programs, and logic instructionswhich are executed by the processor, and a volatile memory, such as arandom-access memory (RAM), for example, that is used as a workingmemory by the processor when executing the firmware, programs and/orlogic instructions stored in the non-volatile memory. The firmwarestored in the non-volatile memory includes programmed instructions forcarrying out basic (i.e., fundamental) operations of the NIC 2, and mayalso include an operating system (OS) of the NIC 2. The feature of a“control unit” of the NIC 2 as described herein can be encompassed bythe CPU 6 individually or in combination with the ASIC 5. The memory 7and the non-volatile memory of the CPU 6 are examples of acomputer-readable recording medium on which an operating system and/orapplication programs of the NIC 2 can be recorded and executed by thecontrol unit of the NIC 2. The control unit of the NIC 2 is configuredto communicate with any of these computer-readable recording media andthus is communicatively connected to these computer-readable media.

A meter interface 8 of the NIC 2 is operatively connected to the CPU 6and receives measured usage data and other operational metrics data fromthe utility meter. According to an exemplary embodiment, the meterinterface 8 can also send information to the utility meter as needed,such as a command to shut off power to the premises associated with themeter, for example.

A transceiver 9 is provided on the NIC 2 for communicating wirelesslywith the utility network 100. The transceiver 9 is an example of anetwork interface that enables the NIC 2 to communicate with other nodesin the utility network 100. As shown in FIG. 2, the transceiver 9includes a data port 10 for providing a two-way data connection betweenthe transceiver 9 and the CPU 6. Similarly, an antenna 11 provides atwo-way data connection between the transceiver 9 and the utilitynetwork 100. A power amplifier 12 drives the antenna 11 and is surgeprotected by a voltage protection device 13. An oscillator 14 generatesa suitable carrier frequency for the power amplifier 12, e.g. 1.8 Ghz. Acrystal oscillator 15 generates an appropriate frequency, e.g. 9.2 Mhz,which provides a stable clock signal to the CPU 6 and the ASIC 5, andalso stabilizes the carrier frequency of the oscillator 14. When themeter and NIC 2 are powered up, the CPU 6 controls the transceiver 9, byway of commands received from the ASIC 5, to progress through variousstages of network connection, to thereby establish the meter 130 as afunctioning node in the network 100.

In the illustrated embodiment, an LED 16 is provided on the NIC 2 andoperatively connected to the CPU 6, to indicate the status of the meterand the NIC 2 during an attempted connection of the utility meter 130with the utility network 100. In an exemplary embodiment, a single colorLED can be used. In this case, the CPU 6 can communicate the variousstates of connectivity by controlling the LED 16 to vary its flashpattern. Alternatively, a multi-color LED, such as a tri-color LED, canbe used, and selectively controlled by the CPU 6 to illustrate variousstates respectively associated with predefined color and/or flashingpatterns. A more detailed discussion of these operations can be found inpreviously identified application Ser. No. 12/139,413.

III. Generation and Transmission of Operation Data from Nodes in theUtility Network

In operation, the utility meters 130 monitor one or more operatingparameters of the utility meter 130, and generate and transmit operationdata representing the monitored operating parameter(s) of the utilitymeter 130. For example, the utility meters 130 can monitor usage datarepresenting an amount of a commodity consumed over a particular periodof time, generate operation data representing the monitored usage data,and transmit the generated operation data to the communication station120 of the utility provider via the network 100. For example, anelectric utility meter 130 can transmit to the communication station 120an amount of electric power consumed at the location of installation ofthe utility meter 130 on an hourly basis. The frequency of communicationbetween the utility meter 130 and the communication station 120 can bedefined to occur at any desired time interval to facilitate properoperation of the meters 130 and collection of operation data from themeters 130.

The utility meters 130 can also monitor operational metrics associatedwith the operation of the NIC 2 and/or associated meter, generateoperation data representing the monitored operational metrics, andtransmit the generated operation data to the communication station 120.The following are examples of the types of operational metrics data thata utility meter 130 can monitor and transmit to the communicationstation 120. For example, the utility meters 130 can transmit (i)security credential information of the meter 130, (ii) network statusinformation, such as whether the meter 130 encountered any transmissionor reception failures in communicating with another node in the network100, (iii) operational power information, such as if the meter 130 waspowered off for a predetermined period, if the power supply to the meter130 is below a prescribed operational threshold, and if the meter 130switched to battery power during operation due to an interruption in theAC power supply, (iv) restart information, such as when the meter 130restarts (reboots), as well as the number of times that the meter 130has restarted over a predetermined period of time, (v) commodityattribute information such as the temperature, pressure, and voltagevalues of the commodity being supplied to the utility meter 130, and(vi) counter information including an integer value (e.g., the numberfour (4)) representing a value counted by the control unit of the NIC 2,such as the number of times the NIC 2 has received a request tocommunicate with another node in the utility network 100. The usage dataand operational metrics data that can be monitored in the meter 130 andtransmitted from the meter 130 to the communication station 120 willcollectively be referred to as “operation data” hereinafter, unlessotherwise noted. The operation data transmitted from a meter 130 to thecommunication station 120, via one or more other meters 130 and/or anaccess point 110, for example, can include one or more of theabove-described types of usage data and operational metrics data.

The communication station 120 records the operation data received fromeach node in the network 100 at the time the operation data is received.The communication station 120 maintains an information database that hasrecorded therein the operation data received from each node in thenetwork 100, as well as the operation data received from each node inrelation to other nodes in the network 100. For example, thecommunication station 120 can record operation data for a plurality ofnodes in a predetermined geographic area.

The exemplary utility network 100 illustrated in FIG. 1 is distinct fromthe distribution network (e.g., electrical, gas, water distributionnetworks) which distributes a particular commodity to the meters 130.The exemplary utility network 100 is a communication network throughwhich the meters 130 can communicate with the communication station 120of the utility provider, either directly with the communication station120, or via one or more other meters 130, access points 110, and/orrelays 140. The exemplary utility network 100 therefore operates inconjunction with the distribution network, in that the exemplary utilitynetwork 100 enables the nodes in the utility network 100 to communicatewith the communication station 120 to report operation data to thecommunication station 120 and to receive operation commands from thecommunication station 120, whereas the distribution network distributes(i.e., supplies) one or more commodities to the meters 130. Therefore,while the exemplary network 100 permits the communication station 120 ofthe utility provider to communicate with the nodes in the network 100,it is to be understood that the exemplary communication network 100 isdistinct from the distribution network that distributes a particularcommodity to the meters 130 with which the NICs 2 are respectivelyassociated. Accordingly, as used herein, reference to a node or nodes inthe utility network 100 is intended to encompass utility meters 130,access points 110 and/or relays 140 having a utility network interfacedevice associated therewith, to enable the utility meter 130, accesspoint 110 and/or relay 140 to communicate with the communication station120 of the utility provider via the exemplary utility network 100. Inaddition, the communication station 120 of the utility providerconstitutes a node in the utility network 100.

IV. Exemplary Communication Station

FIG. 3 is a block diagram of an exemplary configuration of thecommunication station 120 of a utility provider according to at leastone embodiment. As shown in FIG. 3, the communication station 120includes a control unit 310, a communication unit 320, an input unit330, a notification unit 340, and a memory slot 350.

The control unit 210 includes a processing unit 311, a ROM 312, a RAM313, a memory unit 314, a reception unit 315, and a transmission unit316. The processor unit 311 controls the aggregate functions of eachcomponent of the communication station 120. The processor unit 311 mayinclude a general-purpose processor such as an ARM processor, and/or anASIC. The ROM 312 stores programs, such as an operating system andcomputer-readable application programs, and logic instructions which areexecuted by the processor unit 311. The memory unit 314 is anon-volatile memory which can also record computer-readable applicationprograms. The memory unit 314 also has recorded therein theaforementioned information database of operation data received from thenodes in the network 100. The memory slot 350 is configured to receive aremovable non-volatile memory card and/or disc inserted therein, such asa CD-ROM, DVD-ROM, BD-ROM, flash memory, optical memory, etc. The memoryslot 350 communicatively couples terminals of the removable memorycard/disc to the control unit 310 to provide the components of thecontrol unit 310 access to data and application programs recorded on thememory card/disc, and to store data thereon. The RAM 313 is used as aworking memory by the processor unit 311 when executing the programs andlogic instructions recorded in the ROM 312, memory unit 314 and/ormemory card/disc inserted into the memory slot 350. The ROM 312, memoryunit 314 and memory card/disc inserted into the memory slot 350 areexamples of a computer-readable recording medium on which an operatingsystem and/or application programs of the communication station 120 canbe recorded and executed by the processor unit 311. The processing unit311 is configured to communicate with any of these computer-readablerecording media and thus is communicatively connected to thesecomputer-readable media.

The reception unit 315 receives data from the communication unit 320 andforwards the received data to the processor unit 311 for appropriateprocessing. The transmission unit 316 receives data that is instructedto be sent to the communication unit 320 by the processor unit 311, andtransmits the instructed data to the communication unit 320.

The communication unit 320 is an interface between the communicationstation 120 and the nodes in the network 100. The communication unit 320is configured to transmit information and/or control instructions fromthe communication station 120 to the nodes via a wired transmissionmedium 362 and/or a wireless transmission medium 364. The communicationunit 320 can transmit the information and/or control instructions to oneor more nodes as individual messages, a multicast message or a broadcastmessage. The communication unit 320 also receives operation data fromthe nodes via the wired transmission medium 362 and/or wirelesstransmission medium 364. Received operation data is forwarded to theprocessor unit 311 by the reception unit 315. The processing of theoperation data by the processor unit 311 will be described in greaterdetail below.

The input unit 330 can include keys and pointing devices that can bemanipulated by an operator of the communication station 120. Forexample, the input unit 330 can include a QWERTY keyboard, a trackballor similar selecting and pointing device, a number pad, etc. The inputunit 330 can include a display device configured to visually display aninput received by such keys and/or pointing devices. The input unit 330can also include a multi-input touch screen with a virtual keyboard andbuttons represented in a graphical user interface (GUI). The input unit330 is configured to receive operating instructions from an operator ofthe communication station 120. Operating instructions received by theinput unit 330 are forwarded to the processor unit 311.

The notification unit 340 can be an audio and/or video (AV) deviceconfigured to output an audible and/or visual notification, includingany data pertaining or relevant to the notification. As will bedescribed in more detail below, the control unit 310 is configured todetermine when an anomalous event occurs in connection with theoperation of one or more nodes of the communication network 100, basedon the operation data received from one or more nodes in thecommunication network 100. The notification unit 340 is configured tooutput notification of a determined anomalous event at the time theanomalous event is determined to have occurred. As such, thenotification unit 340 provides real-time notification when an anomalousevent is determined to have occurred with respect to one or more nodesin the communication network 100.

V. Threshold Operating Information

The memory unit 314 includes the aforementioned information database,which has defined and recorded therein threshold operating informationfor nodes in the communication network 100. The threshold operatinginformation includes data indicative of configured acceptable operatingparameters of nodes in the communication network 100 based on respectivelocational information of the nodes in the communication network 100.The threshold operating information defines a threshold value or a rangeof threshold values (i.e., maximum and minimum values) for each type ofinformation to be monitored by the communication station 120.

In addition to or as an alternative to defining a threshold value or arange of threshold values, the threshold operating information can alsodefine a predetermined state or condition, such as a state signalindicating the occurrence or non-occurrence of a current state orcondition (e.g., on or off, connected or not connected, true or false,etc.). The state signal can include a binary value such as zero (0) orone (1) to represent the occurrence or non-occurrence of the state orcondition to be monitored by the communication station 120. In thiscase, the threshold value defined in the threshold operating informationcan be the existence or non-existence of the value representing theoccurrence or non-occurrence of the predetermined state or condition.For example, if the threshold operating information defines whether apremises at which a meter 130 is located is currently receiving aparticular commodity from the associated distribution network, thethreshold operating information can include a value of one (1) toindicate that the associated premises is currently receiving with thecommodity, or a value of zero (0) to indicate that the associatedpremises is not currently receiving the commodity. The thresholdoperating information can be defined based on a various number offactors. For example, the threshold operating information can bepreliminarily based on historical operating patterns of one or morenodes for which the threshold operating information is defined. Thethreshold operating information can also be based on configuredthreshold values that are defined for residential or commercial premisesor distribution devices of a distribution network having similar usage,operational, functional and/or geographic characteristics as the nodefor which the threshold operating information is defined. The thresholdoperating information defined in the memory unit 314 can be configuredby an operator of the communication station 120, and can be modified atany time to reflect changes in operating conditions of the node, thecommunication network 100 and/or the distribution network, for example.The threshold operating information can be recorded with versioninformation identifying the number of times the threshold operatinginformation has been modified for the node for which the thresholdoperating information is defined, to illustrate a historical progressionin the threshold operating information, and to permit the thresholdoperating information to be returned to previous versions ifappropriate. The threshold operating information defined for a node caninclude any operating parameter of a node of the communication network100 which is desired to be monitored. The number of operating parametersdefined in the threshold operating information for one node can differfrom the number of operating parameters defined in the thresholdoperating information for another node.

The threshold operating information recorded in the memory unit 314 isunique to each node, such that unique threshold operating information isrespectively defined and recorded for each node in the utility network.As discussed above, the threshold operating information is defined foreach node based on locational information. The locational informationdefines unique information about the node for which the thresholdoperating information is defined, and thus the threshold operatinginformation of a node, which is based on the locational information ofthe node, is unique for each node.

VI. Examples of Locational Information

For example, the locational information can define: (1) geographicinformation about the premises where the node is located, such asgeographic coordinates of the premises (e.g., GPS coordinates), ageographic area in which the premises is located, a number and type ofother residences or businesses within the geographic area, the locationof the premises with respect to a common access point 110 or multipleaccess points 110 located within a predetermined proximity to each otherthat serve the premises, and/or common geographic utility distributioninformation, such as whether the premises are connected to the samebackhaul to the communication station 120, and whether the premises areon the same distribution grid element, such as a substation, transformerand/or feeder of the distribution network, etc.; (2) connectioninformation indicating whether the node is currently connected ordisconnected to a particular distribution network to receive thecommodity supplied by the distribution network, and the number ofdistribution networks to which the node is connected (e.g., electricity,gas, water); (3) residential usage information of the premises, such aswhether the node is located at a residence with high turnover, includingapartments, rental properties, mobile homes, etc.; (4) attributeinformation of the premises, such as whether the premises is aresidential dwelling, a commercial building, a device of thedistribution network (e.g., a distribution transformer and/or feeder ofa distribution network) and/or a device of the network 100 (e.g., anaccess point, a remote terminal unit (RTU) collecting metering data at adistribution device of a distribution network), and attributes such asthe square footage of the premises and a building style of the premises,including whether the premises is physically attached to other premises(e.g., town homes, or commercial properties constituting part of alarger premises, such as a shopping mall), or whether the premises isphysically detached from other premises; (5) premises comparisoninformation indicating a comparative size of the premises relative toother premises in a predetermined geographic area; (6) load usageinformation indicating devices serviceable at the premises, such aswhether a premises is equipped with an HVAC compressor furnace, roomheaters, a water heater, aquatic devices such as a pool pump, spa orJacuzzi, so-called “smart” appliances, a charge receptacle for a plug-inhybrid electric vehicle (PHEV), etc.; (7) functional informationdescribing a functional use of the premises, such as whether thepremises is a restaurant, a grocery store, a hotel, a device of thedistribution network, etc.; (8) periodic usage patterns indicatinghistorical consumption of a particular commodity during a predeterminedperiod of time, such as historical consumption of electricity during thesummer, and historical consumption of gas during the winter, etc.; (9)financial information such as whether the customer at the premises is inarrears for payment of consumption of the commodity at the premises, andthe frequency of which the customer is in arrears; and (10) constructioninformation indicating a construction and/or repair date of the premisesand the materials used for constructing the premises and/or device ofthe distribution network, such as the date of construction and thematerials used to construct a transformer in a distribution network.

The foregoing types of information that can be defined in the locationalinformation for a node for which threshold operating information isdefined and recorded in the memory unit 314 are examples, and thepresent disclosure is not limited thereto. It is to be understood thatthe locational information defined for a premises at which a node in thecommunication network 100 is located, can be any information whichuniquely defines the premises, and can include any combination ofdifferent types of information which uniquely define the premises.

VII. Locational Information Defined for a Node Enables Unique ThresholdOperating Information to be Defined for Each Node

The locational information defined for a node thus enables respectivelyunique threshold operating information to be defined and recorded foreach node in the utility network. For example, suppose that apredetermined geographic area contains both residential and commercialpremises. In this example, the geographic area is defined as a number ofpremises being serviced by a common access point 110 in the network 100.In this geographic area, there are ten residential premises, twocommercial premises, and one distribution device of a distributionnetwork. As discussed above, the threshold operating information can bebased on configured threshold values that are defined for residences,businesses or distribution devices of the distribution network havingsimilar usage, operational, functional and/or geographic characteristicsas the node for which the threshold operating information is defined. Informulating the threshold operating information for the residentialhomes, the configured threshold values for the ten residential homes canbe preliminarily based on an empirical average monthly consumption rateof 1,000 kWh for residential premises in this geographic area, forexample. However, in this example, the ten residential premises possessrelatively unique attributes, and therefore, recording a commondefinition for the threshold operating information may not accuratelyreflect the attributes and operating parameters of these residentialpremises.

Among the ten residential premises in the above example, four of theresidential premises are townhomes arranged successively in a row in anorder of townhome A, townhome B, townhome C and townhome D. In thisexample, townhomes A and D on the edges of the row are physicallyattached to one other townhome (i.e., townhomes B and C, respectively),and townhomes B and C in the middle of the row are physically connectedto two other townhomes (i.e., townhomes A and C, and townhomes B and D,respectively). Each of these townhomes is approximately 2,500 squarefeet in size. Among the ten residential premises in the above example,two of the residential premises are detached homes. Among these detachedhomes, one of the homes is approximately 8,000 square feet in size,while the other detached home is 15,000 square feet in size. The otherfour residential premises are apartments that are each sub-units of athree-story building. Suppose, for example, that apartment 1 is locatedon the first floor, apartments 2 and 3 are located on the second floor,and apartment 4 is located on the third floor of the apartment complex.Apartments 1 and 4 are each approximately 1,500 square feet in size.Apartments 2 and 3 are each approximately 750 square feet in size.

In view of these attributes, unique threshold operating information canbe defined for each of the residential premises in the geographic areabased on respective locational information. For example, the attributeinformation and premises comparison information concerning therespective square footage of the two detached homes can be defined astwo of the above-identified types of locational information for thedetached homes. In this case, the average monthly consumption rate of1,000 kWh may not be appropriate for the detached homes. As such, thethreshold operating information for the two detached homes can includean increased monthly consumption rate, in view of the likelihood thatthe detached homes would consume a greater amount of a particularcommodity in a given month, as compared to the average monthlyconsumption rate for that geographic area. For example, the thresholdoperating information defined and recorded in the memory unit 314 forthe 8,000 square foot detached home can have a maximum threshold valueof 2,000 kWh per month, and the threshold operating information definedand recorded in the memory unit 314 for the 15,000 square foot house canhave a maximum threshold value of 3,000 kWh per month. These maximumthreshold values defined in the threshold operating information for thedetached homes include data indicative of configured acceptableoperating parameters for the detached homes based on their respectivelyunique locational information.

With respect to the four townhomes in the above example, the respectivelocational information of each townhome can provide the townhomes withunique threshold operating information. For example, threshold operatinginformation defined for townhomes B and C can have a comparatively lowermaximum threshold value of monthly power consumption than townhomes Aand D located on the edges of the row of townhomes. For example, basedon periodic usage pattern information recorded in the memory unit 314,townhomes B and C have historically consumed, on average, less power ina month than townhomes A and D. Based on this locational information,the threshold operating information defined and recorded in the memoryunit 314 for townhome B can have a maximum threshold value of 900 kWhper month. However, suppose, for example, that townhome C is equippedwith a charge receptacle for a PHEV. Based on this additional load usageinformation, the threshold operating information defined and recorded inthe memory unit 314 for townhome C can be increased to have a maximumthreshold value of 1,200 kWh per month, based on the increased powerconsumption for charging the PHEV. Unique threshold operatinginformation can also be defined and recorded in the memory unit 314 fortownhomes A and D, based on their respective unique locationalinformation. For example, suppose that townhome A has an HVAC compressorfurnace which increases the amount of power consumed at townhome Arelative to townhome D. Consequently, the threshold operatinginformation defined and recorded in the memory unit 314 for townhome Acan have a maximum threshold value of 1,300 kWh, whereas the thresholdoperating information defined and recorded in the memory unit 314 fortownhome D can have a maximum threshold value of 1,100 kWh.

Utility providers attempt to implement appropriate load management toprovide efficient distribution of a particular commodity and efficientrevenue collection. To achieve these goals, utility providers haveimplemented the feature of remote disconnect and remote connect(hereinafter abbreviated as “remote disconnect/connect”), by which ameter 130 at a node in the utility network 100 can be disconnected fromthe distribution network to cease reception of a commodity and connected(or re-connected) to the distribution network to begin or resumereception of the commodity. The disconnection and/or connection of themeter 130 from/to the distribution network can be performed by thecommunication station 120 via the network 100, without affecting theconnection of the meter 130 to the utility network 100. For example, thecontrol unit 310 of the communication station 120 can control thecommunication unit 320 to transmit a remote disconnect command and/or aremote connection command to a particular node in the network 100. Uponreceiving the remote disconnect command, the control unit of the NIC 2can control the meter interface 8 of the NIC 2 to transmit informationto the associated utility meter 130 to disconnect the load terminal ofthe meter 130 from the source terminal of the meter 130, for example.When the load terminal of a meter 130 is remotely disconnected from itssource terminal, the meter 130 is not disconnected from the utilitynetwork 100. On the contrary, the meter 130 continues to be a node inthe network 100 due to the provision of the NIC 2. The remotedisconnection and/or connection of the meter 130 obviates the need forservice personnel of a distribution network to visit the physicallocation of the meter 130 to disconnect or connect the meter 130 from/tothe distribution network. When a meter 130 is remotely disconnected orconnected, the meter 130 can transmit to the communication station 120operation data indicating that the meter 130 has been remotelydisconnected or connected. The threshold operating information definedand recorded in the memory unit 314 can include a threshold value ofremote connect/disconnects that can be issued against a particular meter130 in a predetermined time period.

As described above, the locational information of a node can includeresidential usage description information which indicates, for example,whether the node is located at a premises with high turnover. In theforegoing example, the locational information defined for the nodesrespectively located at apartment units 1-4 can indicate that the nodesare located at a transient residence with high turnover, in addition toor as an alternative to defining maximum and/or minimum threshold valuesfor consumption of a particular commodity. For example, the thresholdoperating information defined for the node at apartment 1 located on thefirst floor of the three-story apartment complex can have a maximumthreshold value of two remote connect/disconnects per month. Therespective threshold operating information defined for the nodes atapartments 2-4 can similarly have a maximum threshold value of remoteconnect/disconnects per month. The maximum number of remoteconnect/disconnects per month indicate configured operating parametersof these nodes, based on respective locational information of each node.In addition to defining a maximum threshold value of remoteconnect/disconnects per month, the threshold operating informationdefined and recorded in the memory unit 314 for each node at theapartment complex can also include other operating parameters, such asexpected power consumption values for a given time period, based on thesize of the apartment, the utilities installed in the apartment,historical usage patterns, etc. Furthermore, the threshold operatinginformation respectively defined for each node at apartments 1-4 canalso include information on the particular commodities that the premisesassociated with the meters are authorized to receive. For example, ifelectrical power has been turned off for apartment 2 due to a currentvacancy at the apartment, the threshold operating information definedfor the node at apartment 2 can include information indicating thatapartment 2 is not presently authorized to receive electricity from theappropriate distribution network.

In the foregoing example, two commercial premises (e.g., commercialpremises A, and commercial premises B) and a distribution device of adistribution network are located in the geographic region that isdefined as the number of premises being serviced by the same accesspoint 110. Suppose, for example, that commercial premises A is asupermarket, commercial premises B is a five-story office building, andthe distribution device is a distribution transformer of an electricaldistribution network. The locational information respectively definedfor the nodes located at commercial premises A and B and thedistribution device can each include, for example, one or more of (i)attribute information indicating that the nodes are located at acommercial premises or are a distribution device of a distributionnetwork, and the square footage of the respective premises, (ii) loadusage information indicating device loads at the respective premises,(iii) functional information describing a function of the premises, (iv)periodic usage pattern information indicating historical consumption ofa commodity being monitored, and (v) construction information indicatingconstruction and/or repair information of the premises. For example,with respect to the supermarket of premises A, the locationalinformation can indicate that the supermarket is 20,000 square feet, andis equipped with ten commercial refrigeration units as well as tencommercial freezers. The threshold operating information can thus beuniquely defined for the supermarket based on this locationalinformation.

In addition, the supermarket may have a contractual agreement with adistribution network to reduce power consumption during periods of heavyload in the distribution network, via a HAN or similar localizednetwork, using Zigbee or another protocol, for example. In such asituation, the communication station 120 can transmit a control commandto the node(s) at the meter(s) 130 of the supermarket to temporarilyturn off one or more of the refrigerators and/or freezers of thesupermarket for a predetermined time period. For example, to controldemand at peak times such as during hot days in the summer or cold daysin the winter, the communication station 120 can utilize so-called“demand response events” to automatically adjust the thermostat settingsof one or more of the refrigerators and/or freezers of the supermarketby a predetermined number of increments and/or a predeterminedcoefficient for a limited time period. For instance, during a warmperiod in the summer, an electrical distribution network may have acontractual agreement with the supermarket whereby the refrigeration andfreezer units of the supermarket are to be temporarily turned off for aperiod of ten minutes in an hour during the time of increased demand inthe distribution network. The threshold operating information definedand recorded in the memory unit 314 for the supermarket can thereforeinclude information on the time and duration that each demand responseevent is to occur or has occurred, and when the demand response event isto be concluded according to the scheduled demand response event. Anymaximum threshold values for consumption of a particular commodity canbe modified in the threshold operating information defined for thenode(s) at the supermarket to reflect the occurrence of a demandresponse event.

The threshold operating information defined for commercial premises Band the distribution device may also be based on the unique locationalinformation of these premises. For example, in the case of thefive-story office building of commercial premises B, attributeinformation and functional information defined in the locationalinformation for the node of commercial premises B can include usage datafor particular time periods. For instance, the locational informationdefined for commercial premises B can include information that thecommercial premises B is located in a warm climate area, and thatelectricity consumption during the summer months is increased to provideair conditioning to the commercial premises B. The locationalinformation can also include functional information indicating that thecommercial premises B is customarily occupied during the morning andafternoon, and that electricity consumption values are increased duringthese times of the day.

In the foregoing example, the distribution device is a distributiontransformer of an electrical distribution network. Similar to meters 130located at residential or commercial premises, distribution devices of adistribution network (e.g., substations of the distribution network) canbe equipped with a NIC 2 to enable monitoring of usage, distribution andoperation patterns at the particular distribution device, andcommunication of such monitored values to the communication station 120of the utility provider. A data acquisition device, such as a remoteterminal unit (RTU), can be installed at the distribution device of thedistribution network. The RTUs installed at the distribution devicesrecord various operational metrics and threshold settings such asvoltage, current, switch status, temperature, and oil levels, forexample. A NIC 2 associated with the RTU can monitor these operationalmetrics and threshold settings, via the meter interface 8, andcommunicate the monitored values to the communication station 120 of theutility provider. Accordingly, RTUs having an associated NIC 2 can beone example of the types of meters 130 illustrated in the utilitynetwork 100 of FIG. 1. Similar to utility meters 130 located at aresidential and commercial premises, a NIC 2 associated with an RTU isconfigured to measure and communicate operation data (e.g., consumptiondata and operational metrics data) collected by the RTU and/or theassociated meter at the distribution device to the communication station120.

For example, in the case of a distribution transformer of an electricaldistribution network, the NIC 2 associated with the RTU of thedistribution transformer can measure and communicate operation data suchas voltage, current and temperature values as well as a status of switchreclosers at the distribution transformer to the communication station120 via the utility network 100. In the case of a distribution feederfor a gas distribution network, the NIC 2 associated with the RTU of thedistribution feeder can measure and communicate operation data such astemperature, pressure and gas levels to the communication station 120via the utility network 100. Similarly, in the case of a distributiondevice of a water distribution network, the NIC 2 associated with theRTU of the distribution device can measure and communicate operationdata such as pressure, flow rate and temperature values of the commodityto the communication station 120 via the utility network 100.

In accordance with the above example, locational information defined forcommercial premises C can include, for example, a geographic location ofthe distribution transformer of the electrical distribution network,information about a number of other nodes in the utility network 100located at premises that receive power distributed from the distributiontransformer, maximum and/or minimum threshold values for voltage,current and temperature values that can be measured at the distributiontransformer, and construction information indicating the materials usedto construct the distribution transformer and the date on which thedistribution transformer was put into service in the distributionnetwork. Unique threshold operating information can therefore be definedand recorded in the memory unit 314 based on this unique locationalinformation.

It is to be understood that the locational information, and hence thethreshold operating information, defined for a node in the utilitynetwork 100 is customizable to accommodate any operating condition ofthe premises at which the node is located.

In the foregoing example, unique threshold operating information isrecorded in the memory unit 314 for each node in the particulargeographic area being monitored. Threshold operating information canalso be collectively defined and recorded in the memory unit 314 for aplurality of nodes in a particular geographic area. For example, uniquethreshold operating information can be collectively defined for the fourtownhomes A-D, to assist in determining if an anomalous event hasoccurred with respect to the townhouse complex. Similarly, uniquethreshold operating information can be collectively defined for allnodes in a particular geographic area, such as all nodes being servicedby a common access point 110. Recording such collective thresholdoperating information for the entire geographic area can facilitatedetection of an anomalous event with respect to one or more nodes inthat geographic area. In the foregoing example, a geographic area wasdefined as corresponding to all the nodes being serviced by the sameaccess point 110. This is intended to be an example of a geographicarea, and the present disclosure is not limited thereto. A geographicarea can be defined based on any criteria. For example, a geographicarea can be defined as the number of nodes communicating through aplurality of access points 110 located in a predetermined proximity toeach other. A geographic area can also be defined as nodes communicatingwith multiple access points 110 being serviced by the same communicationstation 120 and/or connected to the same backhaul to the communicationstation 120. In addition, a geographic area can also be defined as anysub-division of a distribution network, such as all nodes located atmeters being serviced by one or more substations, transformers and/orfeeders of the distribution network. Furthermore, a geographic area canbe defined according to any governmental sub-division, such as all nodeslocated within a particular township, neighborhood, city or zone havinga common postal address code, such as a zip code, for example.Accordingly, a geographic area can be defined according to anyconceivable criteria.

VIII. Situational Information

In addition to the unique threshold operating information that isrecorded in the memory unit 314 for each node in the network 100, thememory unit 314 also has recorded therein situational information thatincludes data indicative of configured operation data that is expectedto be received from nodes in the network 100 during a predetermined timeperiod, based on at least one of a condition and event that is occurringduring the predetermined time period. The predetermined time perioddefined in the situational information can be based on, for example, thetime period in which the operation data is expected to be received froma node. If the nodes are configured to report their operation data tothe communication station 120 on a more frequent basis, such as once perday, for example, then the operation data measured in the node willlikely constitute operation data that was measured contemporaneouslywith the time at which the operation data is communicated to thecommunication station 120. Alternatively, if the nodes are configured toreport their operation data less frequently, such as once per week, forexample, then the predetermined time period defined in the situationalinformation can be based on the time period at which the operation datawas measured in the nodes. According to an exemplary embodiment, whencommunicating their respective operation data to the communicationstation 120, the nodes are configured to report a precise time at whicheach portion of the communicated operation data was measured in thenode. For example, if a node is configured to report its operation datato the communication station 120 once per week and the operation datacontains the amount of a particular commodity consumed during the week,the operation data communicated to the communication station 120 canspecify the consumption values measured at any desired time interval,such as the consumption values measured, for example, every hour orevery day in the week for which the operation data is communicated tothe communication station 120.

As discussed above, the threshold operating information defined for anode in the memory unit 314 is unique for each node based on therespective locational information defined for that particular node. Onthe other hand, the situational information recorded in the memory unit314 can be generically defined for two or more nodes such thatsituational information is commonly defined for multiple nodes in thenetwork 100.

The situational information can define a condition and/or event that isoccurring at the time the operation data is received from one or morenodes in the network 100. For example, the situational information candefine a current operational state of the distribution network, such aswhether there is presently an outage or disruption of service in aportion of the distribution network in the geographical area in whichthe node(s) is/are located. For instance, if a node is located in ageographic area which is currently experiencing an outage of electricitysupply, the situational information can define that the communicationstation 120 is not expected to receive usage data representingconsumption of electricity from any of the nodes in the geographic areaexperiencing the outage. The situational information can reflect aconfiguration of the node. For example, if the associated NIC 2 of theutility meter receives its power from the electrical distributionnetwork, an outage in the distribution network could cause the NIC 2 tolose its operating power. In this case, the situational informationcould define that the number of communications from the node is expectedto be zero while the node is experiencing an electrical outage.

Conversely, the situational information could define that thecommunication station 120 is expected to receive operation data from thenodes in the geographic area experiencing the outage, but that the nodesare not receiving electricity which they are supposed to be receiving,and hence the operation data should indicate a consumption rate of zeroduring the outage. For example, as described above, a NIC 2 associatedwith an electric meter can be equipped with a battery as a backup sourcefor power, in the event there is an outage in the electricaldistribution network. If one or more nodes in a predetermined geographicarea are similarly equipped with a battery as an auxiliary power source,these utility meters 130 can therefore continue to report operation datato the communication station 120 via the utility network 100, evenduring the electrical outage. In this case, the situational informationdefined for this geographic area can indicate that the geographic areais experiencing an outage, but that the nodes in the network 100 arestill expected to communicate measured operation data, even if themeasured operation data represents that the commodity is not presentlybeing consumed due to the outage.

Alternatively, the situational information can define that distributionof a commodity is fully operational and no outages or servicedisruptions have occurred in the geographical area in which the node(s)is/are located. Such situational information reflects a currentoperating condition in the distribution network.

The situational information can also define seasonal information at thetime the operation data is being received from one or more nodes in theutility network 100. For instance, the situational information candefine that the current season is the summertime. Such seasonalinformation can have an effect on the operation data that is expected tobe received from one or more nodes in the utility network 100. Forexample, in a geographic area in which electricity is supplied to powerair conditioners and gas is supplied to operate heating units, it can beexpected that electricity consumption values will be comparativelygreater in the summer than in the winter, whereas gas consumption valuescan be expected to be comparatively greater in the winter than in thesummer. The situational information can also define current weatherconditions. For example, the situational information can define that acurrent geographical area is currently experiencing increasedtemperatures relative to historical patterns.

The situational information can also define operational information withrespect to one or more nodes in the utility network 100 as well asoperational information with respect to the operation of the utilitynetwork 100. For example, the situational information can define thatthe security credentials of one or more neighboring nodes have beencompromised. In this case, the situational information can define alimited type of communications that a node can accept from thecompromised nodes. For example, in operation, a first node may operateas a relay or a proxy for a second node to transmit the operation dataof the second node to an access point 110 in the utility network 100. Ifit is determined that the security credentials of the second node havebeen compromised, the communication station 120 can transmit a controlcommand to the first node instructing the first node not to listen foroperation data reported by the second node. Instead, the situationalinformation recorded for the first node in the memory unit 314 canindicate that the first node is not permitted to transmit the operationdata of the second node to another node in the network 100.

The situational information can be commonly defined for multiple nodesin a predetermined geographic area, and can include any combination ofinformation on conditions and/or events which can have an effect on theoperation data which is expected to be received from one or more nodes.For example, the situational information can be any combination ofevent-, operational-, seasonal and/or weather-based conditions.

The situational information defined and recorded in the memory unit 314can alter the acceptable operating parameters defined in the thresholdoperating information for one or more nodes, based on prevailing event-,operational-, seasonal and/or weather-based conditions reflected in thesituational information. For example, suppose that the thresholdoperating information defined for a plurality of nodes in a geographicarea includes a respectively unique maximum threshold value ofelectricity consumption for the month of August. If the geographic areais experiencing a heat wave during August, the maximum threshold valuesdefined in the respective threshold operating information for thesenodes can be proportionally increased (e.g., by a factor of 5%) toreflect an increased demand for electricity consumption to power airconditioning units at the premises at which these nodes are located.

Similarly, the situational information recorded in the memory unit 314can reduce a threshold value defined in the respective thresholdoperating information of one or more nodes based on an event-,operational-, seasonal and/or weather-based condition. For example, ifthe threshold operating information of a plurality of nodes in aparticular geographic area defines a maximum number of remoteconnect/disconnects that can be issued against these nodes in aparticular season, the maximum number of remote connect/disconnects canbe reduced by a proportional or numeric amount (e.g., from five remoteconnect/disconnects to three remote connect/disconnects) to reflect anexpected number of remote disconnect/disconnects based on certainweather conditions.

In the above examples, the situational information and the thresholdoperating information pertain to the same or similar operation data thatare to be received from nodes and monitored in the communication station120. According to an exemplary embodiment, the situational informationcan be directed to different operation data than the operation datadefined in the threshold operating information. For example, thresholdoperating information defined for a node can relate to maximum and/orminimum threshold values of consumption of a particular commodity. Onthe other hand, the situational information can relate to an operationalmetric such as the number of communications one node is expected toreceive from another node in a particular time period. For example, ifit is suspected that the security credentials of one or more nodes in agiven geographic area have been compromised, the situational informationdefined for this geographic area can specify a limit on the number oftimes a first node is expected to receive communications from anothernode in the geographic area. For example, the situational informationdefined for the nodes in this geographical area can define a limit onthe number of times a first node can act as a relay or a proxy for asecond node to forward the operation data of the second node to thecommunication station 120.

Common situational information can be defined for a plurality of nodesbased on any criteria related to the operation of one or more nodes inthe utility network 100, the communication functions of the utilitynetwork 100, and/or the operation of the distribution network. Forexample, situational information can be defined for a plurality of nodesbased on expected response events from the nodes in a particular season,expected response events based on event-, weather- and/orseasonal-related conditions, expected response events from a number ofnodes in a predetermined geographic region, expected response eventsfrom nodes communicating through a common communication channel in theutility network 100 (e.g., the nodes are serviced by one or more of thesame access points 110), expected response events based on scheduleddemand periods, and expected quantities of consumption.

The threshold operating information defined for an individual node orfor a predetermined group of nodes in the utility network 100, and thesituational information defined for nodes in the utility network 100 arerecorded in the memory unit 314. The recorded threshold operatinginformation and/or situational information can be updated in thecommunication station 120 to accommodate modified operating parameters.For example, an operator of the communication station 120 can update ormodify the defined threshold operating information and/or situationalinformation via the user interface of the input unit 330 of thecommunication station 120. In addition, the control unit 310 can also beconfigured to automatically alter the threshold operating informationand/or situational information defined in the memory unit 314 inresponse to modified operating parameters of one or more nodes in theutility network 100, the utility network 100, and/or the distributionnetwork. For example, in the event there is an outage in a particulardistribution network, the control unit 310 can be configured toautomatically modify the threshold operating information defined for oneor more nodes as well as the situational information defined for one ormore nodes to reflect different operating conditions caused by theoutage. When the outage is corrected and distribution of the commodityis resumed, the control unit 310 can be configured to automaticallyreturn the altered threshold operating information and situationalinformation to their previous definitions. According to an exemplaryembodiment, the control unit 310 can be configured to automaticallyadjust the threshold operating information and/or situationalinformation by the processor unit 311 executing an application programin which these operations are defined and which is recorded on acomputer-readable recording medium of the communication station 120(e.g., the ROM 312, memory unit 314 and/or memory card/disc insertedinto the memory slot 350).

IX. Exemplary Operations of the Control Unit of the CommunicationStation

FIG. 4 is an explanatory diagram illustrating exemplary operationsperformed by the control unit 310 of the communication station 120 indetecting whether an anomalous event has occurred in connection with oneor more nodes in the utility network 100. As described above, uniquethreshold operating information is defined and recorded in the memoryunit 314 for the nodes in the utility network 100. The thresholdoperating information includes data indicative of configured acceptableoperating parameters of the nodes in the utility network 100 based onrespective locational information of the nodes in the utility network100. In addition, the memory unit 314 also has situational informationdefined and recorded therein for the nodes in the utility network 100.The situational information includes configured operation data (OD) thatis expected to be received from one or more nodes in the utility network100 during a predetermined time period, based on at least one of acondition and event that is occurring during the predetermined timeperiod.

As illustrated in FIG. 4, the communication unit 320 receives operationdata from one or more nodes in the utility network 100. The nodes can beconfigured to transmit their respective operation data to thecommunication station 120 at predetermined time intervals (e.g., hourly,once a week, etc.). Alternatively or in addition, the control unit 310can cause the communication unit 320 to transmit a command instructionto a particular node, which, if it is currently operational, willtransmit its operation data to the communication station 120 uponreceipt of the command instruction.

For clarity of illustration, the exemplary embodiment of FIG. 4 will beinitially described with respect to an example where the communicationstation 120 receives operation data from a single node in the utilitynetwork 100. However, it is to be understood that the communicationstation 120 can receive operation data from a plurality of nodes at anypoint in time and individually process the operation data received fromthe plurality of nodes in parallel. Upon receipt of the operation datafrom a node, the communication unit 320 forwards the received operationdata to the reception unit 315, which in turn forwards the receivedoperation data to the processor unit 311. The reception unit 315 canfunction as a buffer for received operation data, and can transmitspecific received operation data to the processor unit 311 according tovarious buffering techniques. For example, the reception unit 315 canoperate as a first-in first-out (FIFO) buffer in which the receptionunit 315 transmits received operation data to the processor unit 311 inthe order in which the operation data is received. Alternatively, thereception unit 315 can detect whether certain operation data is to beprioritized, and transmit operation data having a higher priority to theprocessor unit 311 before transmitting operation data having a lowerpriority. For example, the nodes in the utility network 100 can beconfigured to define a priority designation in the operation data, andthe reception unit 315 can appropriately transmit the operation data tothe processor unit 311 in accordance with the priority designationdefined in the received operation data. Alternatively or in addition,the reception unit 315 can be programmed to interpret the operatingparameters of the node that are included in the received operation data,and assign a higher priority to specific operating parameters that mayrequire more immediate processing by the processor unit 311. Forexample, the nodes in the utility network 100, when generating theirrespective operation data, can be configured to include an alert message(e.g., an alert flag) in the packet(s) transmitted to the communicationstation 120, and the reception unit 315 can be programmed to prioritizeforwarding of operation data received with an alert message overoperation data not received with an alert message to the processor unit311.

Upon receiving operation data from the node, the processor unit 311accesses the memory unit 314 to obtain the threshold operatinginformation (TOI) and situational information (SI) that are defined forthat node. The processor unit 311 also causes the memory unit 314 tostore the operation data received from the node.

As illustrated in operation 410 of FIG. 4, the processor unit 311 thencompares the received operation data with the obtained thresholdoperating information and with the obtained situational informationdefined for that node. In operation 420, the processor unit 311determines whether the received operation data represents an acceptableoperating condition for the node based on the comparison of theoperation data with the threshold operating information and thesituational information defined for the node. If the operation datareceived from the node represents an acceptable operating conditionbased on the comparison of the received operation data with thethreshold operating information and the situational information definedfor the node, the processor unit 311 next performs operation 430, inwhich the processor waits to receive new operating data from a node inthe utility network 100.

On the other hand, if the operation data received from the node does notrepresent an acceptable operating condition for the node based on thecomparison of the operation data with the threshold operatinginformation and the situational information defined for the node, theprocessor unit 311 performs operation 440, in which the processor 440determines that an anomalous event has occurred with respect to thenode. Based on this determination, the processor unit 311 then performsoperation 450, in which the processor unit 311 controls the notificationunit 340 to output notification of the detected anomalous event. Theprocessor unit 311 can also control the memory unit 314 to record thenotification in association with the node for which the anomalous eventwas detected.

The notification outputted by the notification unit 340 can identify thenode for which the anomalous event has occurred, a description of theanomalous event, and the time and date that the operation data wasreceived from the node. The notification outputted by the notificationunit 340 enables an operator of the communication station 120 torecognize the existence of the anomalous event contemporaneously withthe detection of the anomalous event. Upon receiving the notification,the operator of the communication station 120 can implement variouscorrective measures. For example, the operator of the communicationstation 120 can shift loads away from one or more premises associatedwith the nodes for which an anomalous event was detected, isolate theaffected nodes from being able to communicate with other nodes in theutility network 100, impose restrictions on the operations that anaffected node can perform, conduct an investigation to determine thecause of the anomalous event, and dispatch a service technician toinstitute corrective measures to resolve the anomalous event. Inaddition, since notification of the anomalous event is reported at thetime the anomalous event is detected, inaccurate operation data, such ascommodity consumption values, for example, and any resultant loss inrevenue for the malfunctioning node can be minimized. For example, uponbeing notified of the anomalous event, the operator of the communicationstation 120 can initiate an investigation into the cause of theanomalous event and respond with appropriate action.

FIGS. 5A-5C respectively illustrate three exemplary embodiments of theconfiguration of the processor unit 311 in comparing the operation datareceived from a node with the threshold operating information and thesituational information defined and recorded in the memory unit 314 forthe node. For clarity of illustration, the configuration of theprocessor unit 311 is described in terms of various processingoperations. For example, the processor unit 311 can be configured toperform the illustrated operations by executing an operating systemand/or application program recorded in a computer-readable recordingmedium of the communication station 120.

In operation 502 of the exemplary embodiment of FIG. 5A, the processorunit 311 first compares the operation data received from a node with thethreshold operating information defined and recorded for that node inthe memory unit 314. In operation 504, the processor unit 311 determineswhether the received operation data represents an acceptable operatingcondition for the node based on the comparison of the received operationdata with the threshold operating information defined for that node.

If, in operation 504, the processor unit 311 determines that thereceived operation data represents an acceptable operating condition forthe node, the processor unit 311 then performs operation 506. Inoperation 506, the processor unit 311 compares the received operationdata with the situational information defined and recorded for the nodein the memory unit 314. In operation 510, the processor unit 311determines whether the received operation data represents operation datathat is expected to be received from nodes in the utility network 100during a predetermined time period in which the operation data isreceived, based on the comparison of the received operation data withthe situational information defined for that node. For example, ifsituational information indicating operation data that is expected to bereceived during the month of January is defined in the memory unit 314for all nodes in a predetermined geographic area of which thetransmitting node is a member, then the processor unit 311 compares theoperation data received from this node to determine if it represents theoperation data that is expected to be received from the group of nodesin the month of the January. If the operation data received from thenode represents operation data that is expected to be received from thenode during the time period in which the operation data is expected tobe received, the processor unit 311 proceeds to perform theabove-described operation 430 in which the processor waits for the nextoperation data to be received.

On the other hand, if in operation 510, the processor unit 311determines that the received operation data does not represent operationdata that is expected to be received, based on the comparison of thereceived operation data with the situational information defined forthat node, then the processor unit 311 proceeds to perform theabove-described operations 440 and 450 in succession.

If the processor unit 311, in operation 504, does not determine that thereceived operation data represents an acceptable operating condition forthe node based on the comparison of the received operation data with thethreshold operating information defined for that node, the processorunit 311 then performs operation 508. In operation 508, the processorunit 311 determines whether the acceptable operating parameters definedin the threshold operating information for the node have been altered inthe situational information defined for the node. As described above,the situational information defined and recorded in the memory unit 314can alter the acceptable operating parameters defined in the thresholdoperating information for one or more nodes, based on prevailing event-,operational-, seasonal and/or weather-based conditions reflected in thesituational information. For example, suppose that the thresholdoperating information defined for a node in a geographic area includes amaximum threshold value of electricity consumption for each day in themonth of August. If the geographic area is experiencing a heat waveduring August, the maximum threshold values defined in the respectivethreshold operating information for these nodes can be proportionallyincreased (e.g., by a factor of 5%) in the situational informationdefined for the nodes in this geographic area to reflect an increaseddemand for electricity consumption to power air conditioning units atthe premises at which these nodes are located.

In accordance with the exemplary embodiment of FIG. 5A, suppose thatthreshold operating information recorded in the memory unit 314 for anode in a particular geographic area includes a maximum threshold valueof 40 kWh per day of electricity consumption for the premises at thatnode. If the geographic area is experiencing a heat wave, situationalinformation can be defined and recorded in the memory unit 314 for thosenodes in the geographic area to increase the maximum threshold value ofdaily electricity consumption by 5% during the heat wave. In this case,the situational information defined for the node can indicate a maximumthreshold value of 42 kWh of electricity consumption for the premises atthat node during the heat wave. In this example, suppose that the nodetransmits operation data to the communication station 120 that indicatesa total consumption value of 41 kWh in a day during the heat wave. Uponreceiving this operation data from the node, the processor unit 311 willdetermine in operation 504 that the operation data received from thenode does not represent an acceptable operating condition based on thecomparison of the received operation data with the threshold operatinginformation defined for that node. Based on this negative determinationin operation 504, the processor unit 311 will next perform operation508. In this example, the processor unit 311 will determine in operation508 that the received operation data indicating a total dailyconsumption value of 41 kWh does not represent an acceptable operatingcondition, because the total daily consumption value of 41 kWh exceedsthe maximum daily threshold value of 40 kWh defined in the thresholdoperating information for that node. However, in this example, theprocessor unit 311 determines in operation 508 that the acceptableoperating parameters defined in the threshold operating information forthe node have been altered by the situational information defined forthe node. Based on this positive determination in operation 508, theprocessor unit 311 will next proceed to perform the above-describedoperation 506, in which the processor unit 311 compares the operationdata received from the node with the situational information defined forthe node. In this example, the processor unit 311 will then determine inoperation 510 that the received operation data indicating a totalconsumption value of 41 kWh represents operation data that is expectedto be received from the node during the heat wave, because the totaldaily consumption value of 41 kWh included in the operation datameasured during the heat wave is less than the threshold daily maximumconsumption value of 42 kWh included in the situational information thatis defined for the node during the heat wave. Based on thisdetermination in operation 510, the processor unit 311 then proceeds tooperation 430 in which the processor unit 311 waits to receive newoperation data from a node in the utility network 100.

If the processor unit 311 determines in operation 508 that the operatingparameters defined in the threshold operating information for the nodefrom which the operation data was received have not been altered by thesituational information defined for the node, then the processor unit311 proceeds to successively perform the above-described operations 440and 450. For example, if the threshold operating information and thesituational information defined for the node are respectively directedto different operational metrics having no dependent relationship oneach other, then the processor unit 311 will make a negativedetermination in operation 508.

According to an exemplary embodiment of the present disclosure, theprocessor unit 311 determines that an anomalous event has occurred withrespect to one or more nodes if the operation data received from a nodedoes not comport with either the acceptable operating conditions definedin the threshold operating information for the node or the definition inthe situational information of operation data that is expected to bereceived from the node. Accordingly, the exemplary embodiment of FIG. 5Aprovides an advantageous mechanism to determine whether the thresholdoperating information and situational information recorded for a nodedefine different acceptable operating parameters based on the same orsimilar operational metric to be monitored in the communication station120.

FIG. 5B illustrates another exemplary embodiment of the processingoperations performed by the processor unit 311 in determining whether ananomalous event has occurred with respect to one or more nodes in theutility network 100. As an alternative to the exemplary embodiment ofFIG. 5A, the processor unit 311, in operation 522, first compares theoperation data received from a node with the situational informationdefined for the node. In operation 524, the processor unit 311determines whether the received operation data represents operation datathat is expected to be received from nodes in the utility network 100during a predetermined time period in which the operation data isreceived, based on the comparison in operation 522 of the receivedoperation data with the situational information defined for that node.If, based on the comparison of the received operation data with thesituational information defined for the node, the processor unit 311positively determines that the operation data received from the noderepresents operation data that is expected to be received from the nodeduring the time period in which the operation data is expected to bereceived, the processor unit 311 then proceeds to perform operation 526.In operation 526, the processor unit 311 compares the operation datareceived from the node with the threshold operating information definedand recorded for that node in the memory unit 314. Next, in operation528, the processor unit 311 determines whether the received operationdata represents an acceptable operating condition for the node based onthe comparison of the received operation data with the thresholdoperating information defined for that node. If the processor unit 311determines in operation 528 that the received operation data representsan acceptable operating condition based on the comparison of thereceived operation data with the threshold operating information definedfor that node, the processor unit 311 then proceeds to perform operation430 in which the processor unit 311 waits for reception of new operationdata from the node in the utility network 100.

On the other hand, if the processor unit 311 determines in operation 528that the received operation data does not represent an acceptableoperating condition based on the comparison of the received operationdata with the threshold operating information defined for that node, theprocessor unit 311 then successively performs the above-describedoperations 440 and 450.

According to the exemplary embodiment of FIG. 5B, the processor unit 311can determine if the received operation data represents an anomalousevent if the determination in operation 524 is negative. In particular,based on the comparison in operation 522 of the received operation datawith the situational information defined for the node, if the processorunit 311 determines in operation 524 that the received operation datadoes not represent operation data that is expected to be received in thepredetermined time period defined in the situational information, thenthe processor unit 311 can bypass operations 526 and 528. This exemplaryconfiguration of the processor unit 311 can reduce the processingoperations of the processor unit 311 to determine if an anomalous eventhas occurred with respect to one or more nodes in the utility network100. This exemplary configuration is particularly advantageous if commonsituational information is defined for a plurality of nodes, and thesituational information is deemed to have greater significance indetermining whether an anomalous event has occurred. For example,suppose that the situational information defined for a plurality ofnodes in a particular geographic area specifies expected totalconsumption values for both electricity and gas consumption in the nodeslocated in the geographic area. If the operation data received from oneor more nodes in the geographic area indicates gas consumption valuesbut no consumption of electricity, then the processor unit 311 candetermine, based on the comparison of the received operation data withthe situational information defining both expected gas and electricalconsumption values, that an anomalous event has occurred, such as anoutage with the electrical distribution network.

FIG. 5C illustrates an exemplary embodiment in which the processor unit311 is configured to compare, in parallel, the operation data receivedfrom a node with the threshold operating information, and compare theoperation data with the situation information defined for the node. Withreference to FIG. 5C, in operation 532, the processor unit 311 comparesthe operation data received from the node with the threshold operatinginformation defined for the node, and determines in operation 534whether the received operation data represents an acceptable operatingcondition of the node, based on the comparison of the received operationdata with the threshold operating information defined for the node. Inaddition, in operation 536, the processor unit 311 compares the receivedoperation data with the situational information defined for the node,and determines in operation 538 whether the received operation datarepresents operation data that is expected to be received in thepredetermined time period defined in the situational information, basedon the comparison of the received operation data with the situationalinformation defined for the node.

In the exemplary embodiment of FIG. 5C, the separate comparison andresultant determination operations can be performed at the same time, orone after the other. As illustrated in FIG. 5C, if there is a negativedetermination (i.e., “No”) in either operation 534 or operation 538, theprocessor unit 311 proceeds to perform the above-described operations440 and 450 in succession.

If there is a positive determination (i.e., “Yes”) in either operation534 or operation 538, the processor unit 311 proceeds to operation 540.In operation 540, the processor unit 311 determines whether thedetermination results in both operation 534 and operation 538 arepositive. If the processor unit 311 determines that the determinationresults in both operations 534 and 538 are positive, the processor unit311 proceeds to perform operation 430 in which the processor unit 311waits for reception of new operation data from a node in the utilitynetwork 100. If either of the determination results in operations 534and 538 are negative, the processor unit 311 proceeds to perform theabove-described operations 440 and 450 in succession. Accordingly, inthe exemplary embodiment of FIG. 5C, the processing unit 311 determinesthat an anomalous event has occurred if the determination result ofeither operation 534 or operation 538 is negative.

The processing unit 311 can be configured to perform the processingoperations according to the exemplary embodiment of FIG. 5C if, forexample, the threshold operating information and situational informationdefined for a node are respectively directed to different operatingparameters to be monitored in the communication station 120. Forexample, if the threshold operating information recorded in the memoryunit 314 for a node defines a maximum number of demand response eventsthat can be issued against the meter 130 of the node, and thesituational information defined for the node is directed to a maximumnumber of communications that the node is expected to receive fromanother node in the utility network 100, received operation data can becompared to the threshold operating information and situationalinformation directed to distinct operational metrics in parallel,because the threshold operating information and situational informationdefined for the node are not dependent on each other.

In view of the above-described exemplary embodiments, various examplesof threshold operating information, locational information andsituational information are described below to illustrate differenttypes of operating parameters of nodes that can be monitored by thecommunication station 120 to detect whether an anomalous event hasoccurred with respect to one or more nodes in the utility network 100.The following examples illustrate exemplary embodiments of detectingwhether an anomalous event has occurred with respect to one or morenodes in the utility network 100. The present disclosure is not limitedto the specific examples described below.

FIG. 6 illustrates an example of an electrical distribution networkoperating in conjunction with the utility network 100, in whichexemplary embodiments of the present disclosure can be implemented.Reference numeral 610 denotes a power plant which produces theelectrical power to be distributed and consumed in the distributionnetwork. Reference numeral 620 denotes a transmission substation 620which is configured to step down the voltage of the electrical commoditygenerated at the power plant 610. Reference numeral 630 denotes a powersubstation which is configured to further step down the voltage of theelectrical commodity beyond the voltage reduction implemented in thetransmission substation 620. Reference numeral 640 denotes a transformerwhich is configured to further step down the voltage of the electricalcommodity and condition the electrical commodity for consumption atpremises being serviced by the transformer 640. For example, thetransformer 640 can be configured to process the electrical commodity toprovide single-phase 120V AC service to the premises served by thetransformer 640.

In the exemplary embodiment of FIG. 6, the transmission substation 620,power substation 630 and transformer 640 are each equipped with an RTUthat can measure operation data (e.g., operational metrics data andthreshold operation settings) of the associated distribution devices620, 630, 640 and communicate the measured operation data to thecommunication station 120 via the utility network 100. As describedabove, a NIC 2 associated with the RTU can communicate the measuredoperation data to the communication station 120 of the utility provider.An RTU having an associated NIC 2 is an example of a node in theexemplary utility network 100. Accordingly, as used herein, anyreference to a utility meter 620, 630, 640 is intended to encompass anRTU having a NIC 2 associated with the RTU of the distribution device.By being equipped with the RTU and associated NIC 2, the distributiondevices 620, 630 and 640 of the distribution network can thereforemonitor operating parameters (e.g., usage data, operational metricsdata, threshold operation settings, etc.) of the NIC 2 and/or the RTUwith which the NIC 2 is associated, generate operation data representingthe monitored operating parameters, transmit the generated operationdata to the communication station 120 via one or more other nodes in theutility network 100, and receive control instructions as well as otherdata pertaining to the operating parameters of the meters 620, 630, 640and other nodes in the utility network 100.

Furthermore, as described above, the utility meters 130 illustrated inFIG. 6 are also each equipped with a NIC 2 to enable the meters 130 tomeasure operation data from the NIC 2 and/or the meter with which theNIC 2 is associated, communicate the measured operation data to thecommunication station 120 via one or more other nodes in the utilitynetwork 100, and receive control instructions as well as other datapertaining to the operating parameters of the meter 130 and other nodesin the utility network 100.

To be clear, the meters 130, 620, 630, 640 are comprised within theutility network 100. However, for clarity of illustration, the utilitynetwork 100 is shown in FIG. 6 as a communication medium through whichthe nodes 130, 620, 630 and 640 of the utility network 100 cancommunicate with the communication station 120 of the utility provider.

In the exemplary embodiment of FIG. 6, twelve meters 130-A to 130-L areillustrated as being in a predetermined geographic area 650. In thisexample, the geographic area 650 is defined as the number of meters 130being serviced by a common distribution device of the distributionnetwork, such as the transformer 640.

Each of the nodes 130, 620, 630, 640 has unique threshold operatinginformation defined and recorded in the memory unit 314 of thecommunication station 120, based on respectively unique locationalinformation of each of these nodes. In addition, situational informationis defined and recorded in the memory unit 314 for the nodes 130, 620,630, 640. As described above, common situational information can bedefined for a plurality of nodes in the utility network 100. Forexample, common situational information can be defined and recorded inthe memory unit 314 for a plurality of the meters 130, and commonsituational information can be defined and recorded in the memory unit314 for a plurality of the meters 620, 630 and 640.

The utility network 100 enables the communication station 120 to issueremote connect/disconnects against one or more meters 130, 620, 630 and640 in the distribution network, to remotely connect and/or disconnectthe meters 130, 620, 630 and 640 to/from a portion of the distributionnetwork. For example, based on locational information indicating thatnodes 130-A and 130-F are rental properties, threshold operatinginformation can be defined and recorded in the memory unit 314 toinclude an increased maximum threshold value of remoteconnect/disconnects relative to the other nodes 130 in the geographicarea 650, based on the respective unique locational information definedfor the nodes 130 in the geographic area 650. Suppose, for example, thatthreshold operating information defined for node 130-A indicates amaximum threshold number of four remote connect/disconnects per month.This threshold value is based on locational information which indicatesthat the node 130-A is located at a rental property near the beach whichis commonly rented in weekly increments. Based on this locationalinformation, the threshold operating information recorded in the memoryunit 314 for node 130-A is defined to include a maximum threshold valueof four remote connect/disconnects per month, which reflects that aremote disconnect/connect could be issued to the meter 130-A by thecommunication station 120 after each weekly rental period.

In this example of the weekly rental property at node 130-A, supposethat the situational information is not related to a maximum or minimumthreshold value for the number of remote connect/disconnects that can beissued against the meters 130 in the geographic area. Rather, commonsituational information is defined for nodes 130 in the geographic area650 to indicate that the geographic area is currently experiencing aheat wave, and as such, the maximum daily threshold consumption valuesfor each of the nodes 130 are increased by a factor of 5%. In thisexample, suppose that the communication station 120 receives operationdata from the node 130-A indicating that a total of six remotedisconnect/connects have been issued against the meter 130-A in a month.In accordance with the exemplary embodiments of FIGS. 4 and 5A-5C, theprocessing unit 311 of the communication station 120 will compare theoperation data received from the node 130-A with the threshold operatinginformation and situational information defined for the node 130-A. Inthis example, the situational information defined for nodes 130 does notpertain to an acceptable number of remote connect/disconnects that canbe issued against the meters 130. Consequently, the comparison of thereceived operation data of node 130-A indicating a total number of sixremote connect/disconnects is not incompatible with the situationalinformation defined for nodes 130. However, the total number of sixremote connect/disconnects included in the operation data received fromthe node 130-A exceeds the maximum number of remote connect/disconnectsdefined in the threshold operating information for the node 130-A.Consequently, the processing unit 311 will determine that the operationdata received from the node 130-A does not represent an acceptableoperating parameter, based on the comparison of the received operationdata with the threshold operating information defined for the node130-A.

Now, suppose that the situational information defined for nodes 130 isrelated to a maximum number of remote connect/disconnects in a givenmonth. For example, suppose that the month is February, and the weeklyseaside rental property at which node 103-A is located, is rentedinfrequently in the winter months, such as once per month. The otherrental property in the geographic area 650 at which node 130-F islocated is an apartment that is rented in monthly increments. In view ofthis information, the situational information defined for nodes 130 inthe geographic area 650 indicates a maximum threshold value of tworemote connect/disconnects per month. Suppose that the node 103-Atransmits to the communication station 120 measured operation dataindicating a total number of four remote connect/disconnects in themonth of February. Upon receiving this operation data from the node103-A, the processing unit 311 will compare it with the thresholdoperating information and the situational information defined for thenode 103-A. As described above, the threshold operating informationdefined for node 103-A is defined in this example to include a maximumthreshold value of four remote connect/disconnects per month. Since thenumber of four remote connect/disconnects per month included in theoperation data received from the node 130-A comports with the thresholdvalue of four remote connect/disconnects per month as defined in thethreshold operating information for the node 130-A, the processing unit311 can determine that the received operating data represents anacceptable operating condition with respect to node 130-A.

However, the total number of four remote connect/disconnects per monthincluded in the operation data received from the node 130-A exceeds themaximum threshold value of remote connect/disconnects per month includedin the situational information for the nodes 130 in the geographic area650. Consequently, based on this comparison, the processing unit 311will determine that an excessive number of remote connect/disconnectshave been issued against the meter 130-A, and will resultantly determinethat an anomalous event has occurred with respect to node 103-A in themonth of February. Based on this determination, the processing unit 311will control the notification unit 340 to output notification of thedetermined anomalous event.

Accordingly, the communication station 120 can determine that ananomalous event has occurred when an excessive number of remoteconnect/disconnects are issued against the same meter in a predeterminedtime period.

In another example, the communication 120 can determine whether remoteconnect/disconnects are issued to an excessive number of nodes in aparticular geographic area during a predetermined time period. Since theprocessing unit 311 records each operation data received from a node inthe memory unit 314, the processing unit 311 can aggregate the operationdata received from a number of nodes to determine whether a specificevent has occurred with respect to the number of nodes in apredetermined geographic area. For example, with reference to FIG. 6,suppose that the communication station 120 has determined that remoteconnect/disconnects have been issued with respect to nodes 130-G, 130-H,130-K and 130-L in the month of February, based on respective operationdata received from these nodes. The respective number of remoteconnect/disconnects issued to nodes 130-G, 130-H, 130-K and 130-L in themonth of February may not be indicative of individual anomalous eventswith respect to these individual nodes.

However, when remote connect/disconnects are issued to a number of nodesin a predetermined geographic area within a specified time period, itcould be indicative of an anomalous event occurring in that geographicarea. As illustrated with the dotted line in FIG. 6, the nodes 130-G,130-H, 130-K and 130-L are commonly located in a subsection 652 of thegeographic area 650. To monitor such events, situational information canbe defined for a particular geographic area (e.g., geographic area 650,geographic area 652) to include a maximum threshold number of remoteconnect/disconnects that can be issued to a number of nodes in aparticular geographic area. For example, suppose that situationalinformation is defined in the memory unit 314 to indicate that a maximumthreshold number of four remote connect/disconnects can be issued to anycombination of nodes 130-G, 130-H, 130-K and 130-L in the geographicarea 652 in a month. Suppose further, for the sake of simplicity, thatthe respective threshold operating information for each of nodes 130-G,130-H, 130-K and 130-L includes a maximum threshold value of two remoteconnect/disconnects per month. Suppose that the operation data receivedfrom node 130-G indicates that two remote connect/disconnects have beenissued against the premises associated with node 130-G in the month, theoperation data received from node 130-H indicates that one remoteconnect/disconnect has been issued against node 130-H in the month, theoperation data received from node 130-K indicates that two remoteconnect/disconnects have been issued against node 130-K in the month,and the operation data received from node 130-L indicates that oneremote connect/disconnect has been issued against node 130-L.

Accordingly, in this example, a total number of six remoteconnect/disconnects have been issued against nodes 130-G, 130-H, 130-Kand 130-L in the month. Based on their respective threshold operatinginformation indicating a threshold maximum value of two remoteconnect/disconnects per month, the processing unit 311 will notdetermine that the nodes 130-G, 130-H, 130-K and 130-L have individuallyexceeded the maximum threshold value of remote connect/disconnectsdefined in their respective threshold operating information. However,the total number of remote connect/disconnects received for the nodes130-G, 130-H, 130-K and 130-L in the geographic area 652 exceeds themaximum threshold value of remote connect/disconnects that can be issuedagainst any combination of nodes located in geographic area 652.Accordingly, by aggregating the operation data received from the nodes130-G, 130-H, 130-K and 130-L in geographic area 652 and comparing theaggregated operating data with the situational information defined forany node in the geographic area 652, the processor unit 311 candetermine the occurrence of an anomalous event when remoteconnect/disconnects are issued to an excessive number of nodes in aparticular geographic area during a predetermined time period.

Similarly, in view of the foregoing examples, the communication station120 can also determine whether an excessive number of remoteconnect/disconnects are issued against an excessive number of nodes in aparticular geographic area during a predetermined time period. Forinstance, the communication station 120 can determine whether anexcessive number of remote connect/disconnects are issued against anindividual node in the geographic area, and then aggregate thedeterminations based on the individual nodes in the geographic area todetermine whether an excessive number of remote connect/disconnects havebeen issued against an excessive number of nodes in the geographic areaduring a predetermined time period.

According to another example, the communication station 120 can alsodetermine whether the order of requested commands received from a nodeis indicative of an anomalous event. For example, if a meter associatedwith a node has been remotely disconnected by the communication station120, the threshold operating information defined and recorded for thatnode in the memory unit 314 can include a designation that the node iscurrently disconnected from receiving the commodity supplied by adistribution network. As described above, the locational informationdefined for a node can include connection information indicating whetherthe node is currently connected or disconnected from the distributionnetwork to receive the commodity supplied by the distribution network.Based on this locational information, the threshold operatinginformation defined for the node in the memory unit 314 can specify anorder of requested commands that are acceptable to be received from thenode. If the threshold operating information defined for the nodeindicates the current connection state of the node to the distributionnetwork, the processing unit 311 can determine whether the order ofrequested commands received in the operation data from the nodeconstitute an anomalous event. Furthermore, situational information canbe defined for one or more nodes to indicate a maximum threshold valueof connect or disconnect commands received from the node. In accordancewith the above-described exemplary embodiments of FIGS. 4 and 5A-5C, theprocessing unit 311 can compare the operation data received from thenode with the threshold operating information and situationalinformation defined for that node to determine if an anomalous event hasoccurred with respect to the order of requested commands from the node.For example, if a sequence of repetitive connects and disconnects arereceived from the same node, the processing unit 311 can compare thereceived connect/disconnect requests with the threshold operatinginformation and situational information of the node to determine whetheran anomalous even has occurred. In addition, if disconnects are issuedto nodes that are not currently connected, or if remote connectionrequests are received from a node that is already connected, theprocessing unit 311 can compare the received connect/disconnect requestswith the threshold operating information and situational information ofthe node to determine whether an anomalous even has occurred.

According to another example, suppose that a particular geographic areais experiencing an electrical outage. With reference to FIG. 6, thegeographic area can be defined as the number of nodes 130 being servicedby the same transformer 640. If, in this geographic area 650, node 130-Acommunicates operation data to the communication station 120 indicatingthat power has been restored to the meter 130-A, while none of the othernodes 130 in the geographic area 650 have similarly reported restorationof power, the processor unit 311 can determine that an anomalous stateof restoration has occurred with respect to node 130-A. As describedabove, situational information defined for a plurality of nodes in aparticular geographic area can indicate that the geographic area iscurrently experiencing an outage. For example, if the geographic area iscurrently experiencing an outage, the situational information for thenodes in the geographic area can commonly indicate a threshold maximumvalue of zero for the usage data that can be reported by the nodes. Ifnode 130-A communicates operation data to the communication station 120that indicates an hourly consumption value of 1.5 kWh during the outage,the processor unit 311 can determine that the reported operation datafrom node 130-A does not represent operation data that is expected to bereceived from nodes 130 in the geographic area during the outage.Consequently, the processor unit 311 can determine that an anomalousrestoration event has occurred with respect to node 130-A.

The threshold operating information and/or situational informationdefined and recorded in the memory unit 314 can indicate a maximumand/or minimum threshold value for load side voltage during an outage orwhile the node is disconnected from the electrical distribution network.As described above, the locational information defined for a node caninclude connection information indicating the number and types ofdistribution networks to which a meter associated with the node isconnected. For example, if a node is not currently connected to theelectrical distribution network, the threshold operating informationdefined for that node can include a maximum threshold value of 0 kWh forelectrical consumption, based on the location information defined forthe node. In addition, in the case of an outage, the situationalinformation can, as described above, specify a maximum threshold valuefor power consumption during the outage. If the node communicatesoperating data exceeding the threshold defined in either of thethreshold operating information or the situational information, theprocessor unit 311 can determine that an anomalous event has occurred.For example, if voltage is detected at nodes that are not supposed to beconnected to the electrical distribution network, the processing unit311 can determine that an anomalous event (e.g, tampering) has occurredat these nodes. Similarly, with respect to water and gas distributionnetworks, the communication station 120 can determine when the operationdata received from a node has reported consumption of water and/or gaswhen that commodity is not supposed to be consumed at the node.

Similarly, based on the connection information defined in the locationalinformation for a node, the processing unit 311 can determine whether ananomalous event has occurred based on the total number of commoditiesbeing consumed. For example, if the threshold operating informationdefined for the node indicates that the node is authorized to receiveboth gas and electricity, the processor unit 311 can determine thatthere may be a leak or outage when the operation data received from thenode indicates consumption of electricity but not gas. If the outage orleak is known to the communication station 120, the situationalinformation defined for the node can alter the maximum and/or minimumthreshold values defined in the threshold operating information of thenode.

Conversely, if the threshold operating information defined for the nodeindicates that the premises associated with the node is authorized toreceive electricity but not gas, the processor unit 311 can determinethat an anomalous event has occurred when the operation data receivedfrom the node indicates consumption of gas. The consumption of gas bythe node not authorized to receive it may be indicative of theft.

The communication station 120 can also determine seasonally anomalousconsumption patterns based on the threshold operating information andsituational information defined for the node. As described above, thelocational information defined for a node can include periodic usagepatterns indicating historical consumption of a particular commodityduring a predetermined time period, such as historical consumption ofelectricity in the summer and historical consumption of gas in thewinter, for example. Accordingly, unique threshold operating informationcan be defined for a node based on the periodic usage patterns definedfor the node. In addition, situational information can be defined forone or more nodes in a particular geographic region based on periodicusage patterns of the nodes in that geographic region. Operation datareceived from a node in the utility network 100 can thus be comparedagainst the unique threshold operating information defined for the nodeand the situational information defined for nodes in the geographic areain which the node is located. Furthermore, according to an exemplaryembodiment, situational information defined for a node can alter thethreshold operating information defined for the node, based on observedevent-, operational-, seasonal- and/or weather-related conditions. Thethreshold operating information defined for a node can be based on thehistorical consumption patterns of the node during a particular timeperiod. For example, based on historical usage patterns of 35 to 40 kWhof daily electricity consumption for a particular node in the month ofMarch, threshold operating information recorded in the memory unit 314for this node can define a maximum daily threshold value of 40 kWh ofelectricity. If, for example, there is a heat wave during the month ofMarch in a particular geographic area, situational information definedfor the nodes in this geographic area can increment the daily thresholdvalue by a factor of 5%, to accommodate increased energy usage, forexample, to power air conditioners that normally would not be operatedin March. Based on this adjustment, the processor unit 311, whencomparing operation data received from the node that indicates a dailyconsumption amount of 42 kWh, with the threshold operating informationand situational information, can determine that the increased dailyconsumption represents an acceptable operating condition for the node,because the increased daily consumption amount comports with theincrease in the maximum threshold value by the situational information.

The threshold operating information defined for a node can also includecomparative values of the amount of electricity consumed and the amountof gas consumed for a particular time period. For example, suppose that,based on historical usage patterns defined in the locational informationfor the node, the amount of electrical consumption is three timesgreater than the amount of gas consumption in the month of July.Situational information can also be defined for one or more nodes in apredetermined geographic area reflecting similar comparative values ofconsumption between two commodities. Suppose, for example, thatsituational information defined for the nodes in geographic area 650indicates a ratio of 3.5:1 between electrical consumption and gasconsumption in the month of July. The processor unit 311 can compareoperation data received from a node with the threshold operatinginformation and the situational information defined for the node, todetermine whether an anomalous event has occurred with respect to thenode. For example, suppose that in the month of July, a node with theabove-described threshold operating information and situationalinformation reports operation data to the communication station 120 inwhich the amount of gas consumption is twice the amount of electricalconsumption. This operation data does not comport with either thethreshold operating information or the situational information definedfor the node, and therefore, the processing unit 311 can determine thatan anomalous event has occurred with respect to the node.

As described above, the communication station 120 can utilize demandresponse events to control demand at peak times such as during hot daysin the summer or cold days in the winter. For instance, in accordancewith an example described above, the communication station 120 canautomatically adjust the thermostat settings of a commercial premises bya predetermined number of increments and/or coefficient for a limitedtime period. For example, during a warm period in the summer, anelectrical distribution network may have a contractual agreement with asupermarket whereby the refrigeration and freezer units of thesupermarket are temporarily turned off for a period of ten minutes in anhour during the time of increased demand in the distribution network.

Personnel at the supermarket may have the ability to override such eventsettings. If personnel at the supermarket can override such eventsettings, the node(s) at the supermarket could send override requests tothe communication station 120 as operation data. Such override events,if received on a large scale from nodes at similar premises, can posescalability problems and thus should be effectively controlled.Furthermore, when large number of such override requests are received inquick succession, it is suggestive of possibly malicious behavior.

In this example where demand response events are issued to thesupermarket during periods of heavy load, the thermostat settings of therefrigeration units are scheduled to be adjusted for a period of tenminutes in an hour of peak demand. For example, if the thermostatsettings for the refrigeration units of the supermarket are normally setat a temperature of 36° F., the communication station 120 can turn offthe refrigeration unit for a period of ten minutes. At the conclusion ofthis ten minute period, the thermostat is automatically reset to the 36°F. setting. However, suppose that during this ten minute period ofautomatic adjustment, personnel of the supermarket manipulate thethermostat settings back to a desired setting, prior to completion ofthe ten minute adjustment period. As an alternative to such manualoverrides, suppose that personnel of the supermarket attempt tomanipulate the meter to indicate completion of the demand response eventprior to the scheduled end time. For example, personnel may turn offpower to the associated NIC 2 before the scheduled end time of thedemand response event, so that the thermostat settings can bemanipulated without transmission of an override request to thecommunication station 120. When the NIC 2 associated with the meter isturned back on after the scheduled end time of the demand responseevent, the thermostat settings of the meter 130 may no longer beautomatically controlled according to the demand response eventsettings. In addition, a multitude of event starts taking place outsidea scheduled demand response event in a particular geographic area,customer overrides, and randomization windows of demand response eventstart and stop times should be taken into consideration beforedetermining whether there are unexpected starts and stops in scheduleddemand response events.

In view of these concerns, the threshold operating information definedand recorded in the memory unit 314 for nodes to which demand responseevents are issued can include information on the time and duration thateach demand response event is to occur or has occurred, and when thedemand response event is to be concluded according to the scheduleddemand response event. Any maximum threshold values for consumption of aparticular commodity can be modified in the threshold operatinginformation defined for such nodes to reflect the occurrence of a demandresponse event. In addition, situational information can be defined fornodes to which demand response events are issued, to account forattempts to override such demand response events. For example, duringperiods of peak load in which demand response events are issued toparticular nodes in a particular geographic region, situationalinformation defined for such nodes can include data indicating thatoperation data is expected to be received at an increased frequency, ascompared to times during which demand response events are not scheduled.For example, suppose that the meter(s) at the supermarket is/areexpected to transmit operation data once every hour. When a demandresponse event is scheduled for the supermarket, the communicationstation 120 can transmit a control command to the meter(s) 130 at thesupermarket that instructs the meter(s) 130 to transmit operation datato the communication station 120 every minute. The processor unit 311can compare operation data received from the node located at thesupermarket with the aforementioned threshold operating information andsituational information defined for the node, to determine whether ananomalous event has occurred with respect to the node in relation to thecompletion of the demand response event.

Residential and commercial premises may be equipped with a home areanetwork device which enables centralized control of various operatingparameters of various devices at the premises. For example, a home areanetwork device can be utilized by a customer to set in-house temperaturevalues within a specified temperature range during a predetermined timeperiod. Such home area network devices can be configured to execute onedemand response request at a time. If additional demand responserequests are issued with overlapping time periods, the home area networkdevice can respond to the most recent request and ignore contradictinginstructions from previous requests. However, when a large number ofsuch requests are received in quick succession, it can be indicative ofpossibly malicious behavior. For example, the issuance of an anomalousstring of demand response events to the same or an overlapping set ofdevice classes behind one or more participating meters during an ongoingdemand response event that is scheduled for those meters can beindicative of possibly malicious behavior. There may be several deviceclasses serviced by a meter in a home, such as an HVAC compressor orfurnace, room heaters, water heaters, aquatic devices such as a pump fora pool, spa or Jacuzzi, smart appliances, electric vehicles, etc., andone or more of these devices may be required to participate in a demandresponse event. In accordance with an exemplary embodiment, deviceclasses defined in the ZigBee Smart Energy Profile Specification forload control events may be utilized in formulating the thresholdoperating information and/or situational information for nodes at whicha home area network device is installed.

In consideration of the potential for accidental or malicious operationof home area network devices equipped at nodes for which demand responseevents are scheduled, the threshold operating information defined andrecorded in the memory unit 314 for nodes can include information on thetime and duration that each demand response event is to occur or hasoccurred, and when the demand response event is to be concludedaccording to the scheduled demand response event. Any maximum thresholdvalues for consumption of a particular commodity can be modified in thethreshold operating information defined for such nodes to reflect theoccurrence of a demand response event. In addition, situationalinformation can be defined for nodes to which demand response events areissued, to account for attempts to override such demand response events.For example, during periods of scheduled demand response events,situational information defined for such nodes can include dataindicating that operation data is expected to be received at anincreased frequency, as compared to times during which demand responseevents are not scheduled.

In accordance with the exemplary embodiments illustrated in FIGS. 4 and5A-5C, the processor unit 311 can compare operation data measured atsuch nodes with the threshold operating information and situationalinformation defined for the node, to determine whether an anomalousevent has occurred with respect to the node in relation to thecompletion of the demand response event.

The exemplary embodiment of FIG. 6 illustrates an example of adistribution automation system in connection with the distributionnetwork. For instance, as described above, the RTUs and associated NICslocated the nodes 620, 630, 640 corresponding to the distributiondevices of the distribution network enable operation data measured atthese nodes to be communicated to the communication station 120 of theutility provider. In accordance with this exemplary distributionautomation system, the communication station 120 can monitor foranomalous threshold settings in the operation of the nodes correspondingto the distribution devices of the distribution network. For example,the communication station 120 can monitor and detect anomalous thresholdsettings with respect to switch reclosers and power source transfers. Inthe event that an operation setting of the nodes 620, 630, 640 exceeds amaximum or minimum threshold value defined in threshold operatinginformation for these nodes, the processor unit 311 can detect ananomalous event in connection with one or more of these nodes 620, 630,640.

For example, in the case of a set of reclosers protecting a circuit in anormal/standby source application for over-current protection, the nodes620, 630, 640 continuously monitor each phase of voltage magnitude. Whenany phase of voltage drops below a preset level on the controldesignated as the normal source and an over-current condition does notexist, the normal-source recloser can be configured to trip after asettable time delay. A standby-source recloser can then close after asettable time delay. These preset values for the voltage as well as thetrip and close timers for the transfer scheme can be defined in thethreshold operating information for these nodes. Accordingly, when thenodes 620, 630, 640 communicate measured operation data to thecommunication station 120, the processor unit 311 can compare themeasured operation data with the control settings defined in thethreshold operating information.

In another example, the communication station 120 can monitor anautomatic power source transfer scheme from one transformer in adistribution network to another transformer. For example, in theembodiment of FIG. 6, the communication station 120 can record in thememory unit 314 respective threshold operating values in the thresholdoperating information for each node 620, 630, 640 as well as commonoperational threshold values in situational information for the nodes620, 630, 640. In an exemplary embodiment, an automatic power transfermay occur when a breaker opens or the normal source voltage drops belowa predefined pickup value. These preset voltages, delay cycle settingsfor transfers, and settings of the relays pertaining to the breaker andvoltage status can be defined in the threshold operating informationand/or situational information of these nodes 620, 630, 640 based onoperational settings of the nodes 620, 630, 640. In accordance with theexemplary embodiments illustrated in FIGS. 4 and 5A-5C, the processorunit 311 can compare operation data measured at such nodes with thethreshold operating information and situational information defined forthe node, to determine whether an anomalous event has occurred withrespect to the node.

In addition, the threshold operating information and/or situationalinformation defined for the nodes 620, 630, 640 can include thresholdsettings on any battery-powered RTUs and/or radio communication cards todetect whether an anomalous event has occurred with respect to theseoperating parameters.

The threshold operating information defined for one or more of the nodes620, 630, 640 can also include communication parameter values for thenodes 620, 630, 640, such as a defined frequency of communication, acommunication protocol, necessary security credentials for communicationin the utility network 100, etc. Similarly, common situationalinformation pertaining to the communication parameters of the nodes 620,630, 640 can be defined and recorded in the memory unit 314. If any ofthe nodes 620, 630, 640 are disconnected from the utility network 100,the processor unit 311 can detect an anomalous event as a possibletampering with one or more of the nodes 620, 630, 640. For example,according to an exemplary embodiment, the nodes 620, 630, 640 may beconnected to the utility network 100 via one or more ebridges or otherdevices having a similar functionality at any layer of the utilitynetwork 100. An ebridge, as used herein, is a device configured toprovide communicative functions to distribution automation devices ofthe distribution network, via the utility network 100.

The threshold operating information and/or situational operatinginformation defined for a node can specify other nodes of the utilitynetwork 100 with which the node is authorized to communicate and/orother nodes with which the node is authorized to communicate. Forexample, a device which does not possess the requisite securitycertificate chain up to an appropriate operational certificate can beclassified as a non-distribution automation device in the situationalinformation defined for a plurality of nodes in the utility network 100.Furthermore, in the event there is suspected to be a device that lacksthe required security credentials and that is attempting to communicatewith the nodes 620, 630, 640, situational information can be defined forthe nodes 620, 630, 640 to indicate a number of communications that thenodes 620, 630, 640 are permitted to receive in a predetermined timeperiod. In the event that distribution automation traffic is generatedin a non-distribution automation device lacking the required securitycredentials, the nodes 620, 630, 640 can transmit operation dataindicating receipt of a communication from a non-distribution automationdevice. The processor unit 311 can compare the operation data from oneor more of the nodes 620, 630, 640 with their respective thresholdoperating information and the situational information defined for thesenodes 620, 630, 640 to determine whether there is the possibility of anon-distribution automation device attempting to interfere or tamperwith the operation of the nodes 620, 630, 640. For example, according tothe security parameters of the nodes 620, 630, 640, if any of the nodes620, 630, 640 receive distribution automation traffic generated in anon-distribution automation device lacking the required securitycredentials, the nodes 620, 630, 640 can transmit operation dataindicating receipt of the communication from the device lacking therequisite security credentials. The processor unit 311 can determinethat an anomalous event has occurred with respect to the transmission ofdistribution automation traffic from an unauthorized device and transmita control instruction to the node 620,630, 640 which received theunauthorized communication to not accept the communication and pass thecommunication on to a distribution automation device hanging off anebridge. Based on the operation data received from the node 620, 630,640, the processor unit 311 can also detect the originator of theunauthorized communication and record it as anomalous event.

In another example, the processing unit 311 can monitor for possibletransformer overloading in the distribution network. For example,acceptable operating parameters relating to voltage, current and/ortemperature levels as well as average demand levels at the transformers620, 630, 640 can be uniquely defined for each transformer 620, 630, 640based on respective construction information of the transformers 620,630, 640. In addition, where appropriate, common threshold values can bedefined for the transformers 620, 630, 640 as situational information.The measurement of these operating parameter values can be reported bythe nodes 620, 630, 640 as operation data at predetermined time periods,and the processing unit 311 can compare the received operation data withthe threshold operating information and situational information definedfor the nodes to determine whether any of the transformers is beingoverloaded. Upon determining that one or more of the transformers isbeing overloaded, the communication station 120 can transmit a controlinstruction to the particular node 620, 630, 640 to shed a particularamount of the load at the transformer to ease the present overloading ofthe transformer. In addition, threshold operating information andsituational information can be defined and recorded in the memory unit314 to facilitate detection of lateral overloading. For example, a nodealong a feeder line can monitor operational metric data relating to itsoperation as well as the operation of the other nodes 620, 630, 640. Thethreshold operating information defined for each node can include athreshold value of aggregate demand for that particular node, whilesituational information can be defined to include a comparativeaggregate demand of each node 620, 630, 640 in the distribution network.

In another example, unique threshold operating information can bedefined for each node 620, 630, 640 to include construction informationpertaining to operational devices and distribution mediums. The nodes620, 630, 640 can report to the communication station 120 operation datapertaining to data collected by the RTU, and the operation data can becompared with threshold operating information that is based onhistorical operating parameters. In addition, situational informationdefining expected operation data pertaining to the operational metricsof devices and communication mediums in the distribution network can berecorded in the memory unit 314. Based on the received operation data,the processor unit 311 can determine whether there is any feeder orlateral aggregation occurring in the distribution network, for example.If the processor unit 311 determines that feeder or lateral aggregationhas occurred, corrective measures can be implemented. For example, newcopper can be installed to counteract the feeder and lateralaggregation.

Threshold operating information defined for each node 620, 630, 640based on historical operating parameters can be effective for improvingcooperative data sharing among the devices in the utility network 100.For example, threshold operating information defined for one or morenodes can include population data indicating a numerical quantity of aparameter to be monitored. For example, the population data can pertainto the number of feeders, transformers and/or meters associated with aNIC 2 in the distribution network. Situational information directed tooperation data that is expected to be received from these nodes can bedefined and recorded in the memory unit 314. Upon receiving operationdata from the nodes relating to the population data of the nodes, theprocessor unit 311 can compare the received operation data with thethreshold operating information and situational information todetermine, for example, whether there is an unexpected load surge undera particular feeder or transformer, whether the reported operation datais consistent with individualized historical operation data at thefeeder, transformer and/or meter, and/or whether the reported operationdata is consistent with historical operation data of a feeder,transformer and/or meter in a particular geographic area.

In addition, threshold operating information and situational informationcan be defined to designate acceptable security standards forcommunication in the utility network 100. Access failures of a node maybe due to the node having the wrong password, key or certificate. Eachaccess failure can be reported as operation data by the node thatencountered the access failure, or by another node that denied access tothe requesting node lacking the requisite security credentials. Thenumber of access failures reported as operation data to thecommunication station 120 can be aggregated by the processing unit 311and recorded in the memory unit 314. The processor 311 can then map eachaccess failure across the utility network 100 over time to detectpatterns of security breach. Additional security event counters reportedas operation data by a node in the utility network 100 to thecommunication station 120 can include digital signature verificationfailures, integrity check (keyed-HMAC) failures, and packet replays, forexample.

In another example, the communication station 120 can receive operationdata related to geographic coordinates of the nodes in the utilitynetwork 100. For example, at the time of installation, GPS coordinatescan be recorded in the memory unit 314 for each node in the utilitynetwork 100. The respective threshold operating information defined forthe nodes can include the respective GPS coordinates of the node. Thenodes can be configured to report their GPS coordinates as operationdata to the communication station 120 at predetermined intervals. Forexample, when communicating operation data related to measuredconsumption values, the nodes can also designate their respective GPScoordinates in the operation data. The processing unit 314 can build aneighbor table as situational information for the nodes in the utilitynetwork 100. The neighbor table defined in the situational informationcan assist the processor unit 311 to map which nodes are near othernodes in a predetermined geographic area. If the processor unit 311receives from a node operation data including the GPS coordinates of thenode, the processor unit 311 can compare the received operation datawith the GPS coordinates of the node defined in the threshold operatinginformation for the node and with the neighbor table mapped in thesituational information for the nodes in the utility network 100. If atsome point the processor unit 311 detects a deviation between the GPScoordinates included in the operation data received from a node based onthe comparison of the operation data with the threshold operatinginformation and the situational information, the processor unit 311 candetect that an anomalous event has occurred. For example, if theprocessor unit 311 determines that the GPS coordinates included in theoperation data received from a node does not match the GPS coordinatesof the node in the neighbor table defined in the situationalinformation, the processor unit 311 can determine that it is unlikelythat the node which reported the operation data can be a neighbor withits current set of neighbors defined in the neighbor table, which couldpossibly indicate that the node has moved or there has been a tamperingwith the node.

Threshold operating information can also be defined in the memory unit314 to include registration information of the node for which thethreshold operating information is defined. In addition oralternatively, the threshold operating information can includeregistration information of other nodes with which the reporting node isauthorized to communicate. Furthermore, situational information definedfor a plurality of nodes in the utility network 100 can include acompilation of the registered devices in the utility network 100.Operation data received from a node can be compared against theaforementioned threshold operating information and situationalinformation to determine whether an unregistered device is repeatedlytrying to join the utility network 100, and/or communicate in a homearea network at a premise. For example, if a device is not registered inthe communication station and not associated with a specific node of theutility network 100, the processor unit 311 can determine the existenceof the unregistered device and compel it to register with thecommunication station 120 or else prevent nodes in the utility network100 from communicating with the unregistered device until it issuccessfully registered.

According to an exemplary embodiment, a smart grid platform can beutilized to shift large loads to off-peak periods to drive the peakperiod down. Based on load usage information identifying devices thatare serviceable at the premises where a node is located, thresholdoperating information can be defined for the node to restrict operationof large load devices located at the premises. As used herein, a “loaddevice” is a device located at a premises which is operated inaccordance with a particular commodity received at the premises. Forexample, the threshold operating information defined for a node caninclude a maximum threshold value of power that can be consumed at thenode at specific time periods. Situational information recorded in thememory unit 314 can define such periods of peak demand, and decrease theacceptable maximum threshold value of consumption that is defined in thethreshold operating information for a particular node. For example,suppose that a charge receptacle for a PHEV is installed at a premisesat which a node of the utility network 100 is located. If the PHEV isplugged in during a period of peak demand and the operation dataindicating a total consumption value exceeds either the thresholdoperating information or situational information defined for the node,then the processor unit 311 can control the node to turn off the largeload PHEV device. Such threshold operating information and situationalinformation defined for a node can also be utilized to determine theoccurrence of other anomalous events. For example, the processor unit311, based on the comparison of received operation data with thethreshold operating information and situational information defined fora node, can detect a series of spikes in load in a home area networkduring peak hours. The threshold value for detecting a spike in load inmeters and/or devices associated with the home area network can be setaccording to load patterns in the distribution network. In addition, theprocessor unit 311 can detect an unusual peak or off-peak usageconstituted by a statistically significant surge or drop in relation tohistorical usage at the premise, and a statistically significantbaseline usage change at the premises. Furthermore, the processing unit311 can detect unusual changes in comparative usage patterns in apredetermined geographic area, such as when usage patterns at one ormore nodes fluctuates widely in comparison to fluctuations in usagepatterns at other nodes in the geographic area.

In another exemplary embodiment, threshold operating information definedfor a node can include the cryptographic credentials that are requiredto be used by the node to communicate with another node in the utilitynetwork 100. The situational information defined for the nodes in theutility network 100 can include, for example, an aggregation of thesecurity credentials of the nodes in the utility network 100, the numberof communications that a node can make to another node within a specifictime period, and/or an identity of nodes whose cryptographic credentialshave been corrupted. For example, field service units (FSUs) in theutility network 100 are assigned cryptographic credentials to enablethem to communicate with other nodes in the utility network 100. Thecryptographic credentials of the FSUs can be monitored in thecommunication station 100 by logging either security associationformations or additions to neighbor tables on the meters 130, accesspoints 110, ebridges, and/or relays 140 with which the FSUs communicateor attempt to communicate. The nodes with which the FSUs communicate orattempt to communicate can transmit operation data indicating whetherthe cryptographic credentials of a FSU enabled a successfulcommunication with the FSU. The processor unit 311 can cause the memoryunit 314 to record such operating data relating to the cryptographiccredentials of the FSUs to create logs in the communication station 120.The logs can be accessed by the processor unit 311 to locate rogue,blacklisted or lost FSUs, FSUs that have exceeded their allowable limitof the number of transactions but persisted in failed communicationattempts, and/or to detect FSUs deviating from expected routes based ondefined work order management system routes.

Threshold operating information and situational information can bedefined for a node based on any operating parameter which is desired tobe monitored in the communication station 120. The following areexamples of operating parameters which may be measured by a node andmonitored in the communication station 120 to monitor the operationalstate of various devices serviceable at a node, the operational state ofthe utility network 100 and/or the operational state of the distributionnetwork.

For example, minimum and maximum threshold values can be defined inthreshold operating information and situational information to monitorthe temperature of the NIC 2 and/or the associated meter. According toan exemplary embodiment, a thermometer can be installed in the NIC 2and/or associated meter, and when operation data is reported by thenode, the processor unit 311 can detect whether the measured temperaturevalues potentially indicate overheating or impending failures, forexample. Similarly, temperature profile changes can be measured forvarious devices serviceable at a node, the operational state of theutility network 100 and/or the operational state of the distributionnetwork, based on acceptable profile values defined in the thresholdoperating information and expected profile values defined in thesituational information.

In another exemplary embodiment, line impedance trends associated with apower line carrier can be monitored by the communication station 120,based on threshold values defined in threshold operating informationand/or situational information for one or more nodes in the utilitynetwork 100. Fluctuations in line impedance trends can be indicative offeeder or lateral power theft, for example. In addition, measured valuesfor line frequency and line harmonic content can be compared againstthreshold values defined in threshold operating information as well asexpected measurement values defined in situational information based onsimilar operating parameters in a predetermined geographic region. Inaccordance with another exemplary embodiment, threshold operatinginformation defined for a node can include threshold values on spectrumanalysis in connection with the wireless communication techniqueutilized by a utility meter 130, and situational information defined forthe node can include expected spectrum analysis data based on theoperating parameters of other nodes in a predetermined geographic area.For example, if the NIC 2 of the node communicates with other nodes viaradio frequencies (RF), the processing unit 311, upon receivingoperation data from the node, can compare the received operation datawith the threshold operating information and situational information todetermine if the RF bands are becoming too crowded or jammed. Similarly,based on operation data received from nodes, the processing unit 311 canmonitor packet rates of all the nodes to determine if unregistered orunknown devices are using the same network as nodes registered with thecommunication station 120, whether the utility network 100 is close tosaturation, the rate of packet loss in the utility network 100, and/orwhether it would be advantageous to add a relay 140 at a particularlocation to improve traffic distribution in the utility network 100.

The foregoing examples of threshold operating information, locationalinformation and situational information are intended to illustratedifferent types of operating parameters of nodes that can be monitoredby the communication station 120 to detect whether an anomalous eventhas occurred with respect to one or more nodes in the utility network100. The present disclosure is not limited to the foregoing examples.

In exemplary embodiments described above, the control unit 310 of thecommunication station 120 was described as comparing operation datareceived from another node (e.g., utility meter 130) in the utilitynetwork 100 with (1) the threshold operating information defined andrecorded in the memory unit 314 for the node from which the operationdata was received, and (2) the situational information defined andrecorded in the memory unit 314. According to an exemplary embodiment,the control unit 310 can compare the actual operation data received fromanother node with the threshold operating information defined for thatnode, and with the situational information. However, it is possible forthe operation data received from a node to be in a different formatand/or protocol than the threshold operating information and/orsituational information recorded in the memory unit 314. For example,suppose that a node such as utility meter 130 transmits operation datato the communication station 120 indicating a daily consumption rate of40 kWh. The threshold operating information and/or situationalinformation can be respectively defined and recorded in the memory unit314 in a different format and/or protocol than the numerical valueformat of the operation data received from the downstream node. Forexample, the threshold operating information can be defined and recordedin the memory unit 314 of the communication station 120 as a range ofvalues, e.g., 38-42 kWh, and the situational information can be definedand recorded in the memory unit 314 of the communication station 120 asa percentage increase or decrease (e.g., 5%) of the maximum or minimumthreshold value defined in the threshold operating information. Asanother example, the operation data received from a downstream node canbe encrypted and/or encoded according to a predetermined securityprotocol between nodes in the utility network 100.

In the event that the threshold operating information and/or situationalinformation is/are recorded in the memory unit 314 in a different formatand/or protocol than the operation data received from a downstream node,the control unit 310 of the communication station 120 may performconversion and/or calculation operation(s) prior to comparing theoperation data with (1) the threshold operating information and (2) thesituational information recorded in the memory unit 314. For instance,in the above example where the situational information is recorded inthe memory unit 314 as a percentage increase and/or decrease of thethreshold operating information, the control unit 310 would calculatethe maximum and/or minimum threshold value of the situationalinformation based on the value of the threshold operating informationrecorded in the memory unit 314, and then compare the operation datareceived from the downstream node with the calculated maximum and/orminimum threshold value of the situational information. In the aboveexample where the operation data is transmitted to the communicationstation 120 in an encrypted and/or encoded format by a downstream node,the control unit 310 would first decrypt and/or decode the receivedoperation data and then compare the decrypted and/or decoded operationdata with the threshold operating information and the situationalinformation recorded in the memory unit 314. As used herein, theoperation of the control unit 310 in comparing operation data receivedfrom a downstream node with (1) the threshold operating information and(2) the situational information recorded in the memory unit 314 isintended to encompass any preliminary or preparatory conversion and/orcalculation operation(s) performed by the control unit 310 on thereceived operation data, the recorded threshold operating informationand/or the recorded situational information, prior to comparing thereceived operation data with (1) the threshold operating information and(2) the situational information in accordance with the exemplaryembodiments described above.

X. Exemplary Method of Operating a Communication Station of a UtilityProvider

An exemplary embodiment of the present disclosure also provides a method700 of operating a communication station 120 of a utility provider(e.g., a utility network communication device) to detect anomalousevents occurring in connection with at least one node in the utilitynetwork 100. FIG. 7 illustrates various features of the exemplarymethod.

In step S710, threshold operating information and situationalinformation are defined and recorded in the memory unit 314 of thecommunication station 120. In accordance with the exemplary embodimentsdescribed above, the threshold operating information includes dataindicative of configured acceptable operating parameters of the nodes inthe utility network 100 based on respective locational information ofthe nodes in the utility network 100, and the situational informationincludes data indicative of configured operation data that is expectedto be received from nodes in the utility network 100 during apredetermined time period, based on at least one of a condition andevent that is occurring during the predetermined period of time. In stepS720, operation data is received from at least one node in the utilitynetwork 100.

In step S740, the processing unit 311 of the communication station 120compares the received operation data with the threshold operatinginformation and the situational information defined for the at least onenode from which the operating data was received.

In step S740, the processing unit 311 determines whether the receivedoperation data constitutes an anomalous event based on the comparison ofthe received operation data with the threshold operating information andthe situational information in step S730. For instance, in step S740,the processing unit 311 determines whether the received operation datarepresents an acceptable operating condition for the node based on thecomparison in step S730. If the processing unit 311 determines that thereceived operation data represents an acceptable operating conditionbased on the comparison in step S730, the processing unit 311 waits toreceive new operation data from a node in the utility network 100 andtherefore returns to step S720.

On the other hand, if the processing unit 311 does not determine thatthe received operation data represents an acceptable operating conditionfor the node from which the operation data was received, based on thecomparison in step S730, the processing unit 311 determines that ananomalous event has occurred with respect to the node from which theoperation data was received. In step S760, the notification unit 340 ofthe communication station 120 outputs notification of the determinedanomalous event.

In the exemplary method illustrated in FIG. 7, steps S730 and S740 caninclude any of the operations defined with respect to the exemplaryembodiments illustrated in FIGS. 4 and 5A-5C. In addition, the exemplarymethod illustrated in FIG. 7 can include any of the features of theabove-described exemplary embodiments.

Furthermore, another exemplary embodiment of the present disclosureprovides a computer-readable recording medium on which a computerprogram is recorded that causes the control unit 310 of thecommunication station 120 to detect anomalous events occurring inconnection with at least one node in the utility network 100. Withreference to the exemplary embodiment illustrated in FIG. 3, the ROM312, memory unit 314 and/or memory card/disc inserted into the memoryslot 350 can constitute a computer-readable recording medium on which anoperating system and/or application programs of the communicationstation 120 can be recorded and executed by the control unit 310. Thecontrol unit 310 is configured to communicate with any of thesecomputer-readable recording media and thus is communicatively connectedto these computer-readable media. The program recorded on thecomputer-readable recording medium can cause the control unit 310 toperform any of the operations of the exemplary embodiments describedabove.

XI. Exemplary Utility Network Interface Device Configured to DetectAnomalous Events Occurring with Respect to the Utility Network InterfaceDevice

Another exemplary embodiment of the present disclosure provides autility network interface device (hereinafter abbreviated as “NIC 2”)configured to detect anomalous events occurring in connection with atleast one node in the utility network 100. As described above, the NIC 2can be associated with a utility meter in the utility network 100 andconstitute a node in the utility network 100. Accordingly, the NIC 2 canbe configured to detect anomalous events occurring in connection withthe NIC 2 and/or the meter with which the NIC 2 is associated.

With reference to the exemplary embodiment illustrated in FIG. 2, theNIC 2 comprises a memory unit 7. The memory unit 7 has defined andrecorded therein threshold operating information including configuredacceptable operating parameters of the node in the utility network 100.The threshold operating information defined for the node can be uniqueto the particular node in which the threshold operating information isrecorded. The threshold operating information recorded in the memoryunit 7 can be programmed in the memory unit 7 at the time the NIC 2 isinstalled at the meter with which the NIC 2 is associated. Accordingly,threshold operating information can be commonly defined for various NICs2, for example, at the time of installation, and/or the time of initialprogramming of the NICs 2. Alternatively or in addition, the thresholdoperating information can be transmitted to the NIC 2 by thecommunication station 120, via one or more other nodes in the utilitynetwork 100, and defined and recorded in the memory unit 7.Alternatively or in addition, the threshold operating information can begenerated by the NIC 2 based on operating parameters that are monitoredin the NIC 2 over a predetermined period of time. For example,acceptable operating parameters to be defined in the threshold operatinginformation can be based on operating parameters that are monitored inthe NIC 2 over a forty-five (45) day period. The acceptable operatingparameters of the NIC 2 can then be defined based on a predeterminedmetric of the empirically observed operating parameters. For example, ifthe average daily consumption rate of a certain commodity is 40 kWh overthis forty-five day period, the daily threshold consumption value forthis commodity can be defined to be 45 kWh. Alternatively, the thresholdconsumption value of the commodity defined in the threshold operatinginformation can be based on the maximum daily consumption value observedduring the forty-five day period. In the event that the thresholdoperating information defined in the NIC 2 is based on historicallyobserved operating parameters, the NIC 2 itself can generate thethreshold operating information, or the communication station 120 of theutility provider can transmit the threshold operating information to theNIC 2, based on the operation data reported to the communication station120 from the NIC 2.

Similar to the threshold operating information defined and recorded inthe memory unit 314 of the communication station 120, the thresholdoperating information recorded in the memory unit 7 of the NIC 2 caninclude configured threshold values of any operating parameter (e.g.,usage data, operational metric data, etc.) of the NIC 2 and/or theassociated meter that is desired to be monitored. For example, thethreshold operating information recorded in the memory unit 7 caninclude a threshold value or a range of threshold values (e.g., maximumand minimum values) for each type of information that is to be monitoredin the NIC 2.

In addition to or as an alternative to defining a threshold value or arange of threshold values, the threshold operating information can alsodefine a predetermined state or condition, such as a state signalindicating the occurrence or non-occurrence of a current state orcondition (e.g., on or off, connected or not connected, true or false,etc.). The state signal can include a binary value such as zero (0) orone (1) to represent the occurrence or non-occurrence of the state orcondition to be monitored by the communication station 120. In thiscase, the threshold value defined in the threshold operating informationcan be the existence or non-existence of the value representing theoccurrence or non-occurrence of the predetermined state or condition.For example, if the threshold operating information defines whether apremises at which a meter 130 is located is currently receiving aparticular commodity from the associated distribution network, thethreshold operating information can include a value of one (1) toindicate that the associated premises is currently receiving with thecommodity, or a value of zero (0) to indicate that the associatedpremises is not currently receiving the commodity.

The threshold operating information recorded in the memory unit 7 of theNIC 2 can include any of aforementioned types of information that aredefined in the threshold operating information recorded in the memoryunit 314 of the communication station 120 (e.g., usage data, operationalmetric data, etc.). Examples of different types of threshold operatinginformation recorded in the memory unit 7 of the NIC 2 are describedbelow.

The NIC 2 also includes a network interface (e.g., transceiver 9,antenna 11) configured to receive communications from one or more othernodes in the utility network 100, such as a neighboring meter 130, anaccess point 110, a relay 140 and/or the communication station 120, andto transmit communications to one or more other nodes in the utilitynetwork 100.

In addition, the NIC 2 includes a control unit. As described above, thecontrol unit the NIC 2 can be encompassed by the CPU 6 individually orin combination with the ASIC 5. The control unit of the NIC 2 isconfigured to monitor operating parameters of the NIC 2, generateoperation data representing the monitored operating parameters, andrecord the generated operation data in the memory unit 7 of the NIC 2.In addition, the control unit of the NIC 2 is configured to cause thenetwork interface of the NIC 2 to transmit the generated operation datato one or more other nodes in the utility network 100. The operationdata generated by the NIC 2 can be any of the aforementioned types ofoperation data described with respect to the exemplary embodiments ofthe communication station 120. For example, the operation data generatedby the control unit of the NIC 2 can include usage data measured by theNIC 2, operational metrics data of the NIC 2, and operational metricsdata of the associated meter.

The control unit of the NIC 2 is also configured to compare thegenerated operation data with the threshold operating informationrecorded in the memory unit 7, and determine whether the generatedoperation data indicates an anomalous event based on the comparison ofthe generated operation data with the threshold operating informationrecorded in the memory unit 7. In comparing the generated operation datawith the threshold operating information, and determining whether ananomalous event has occurred, the control unit of the NIC 2 isconfigured to perform processing operations similar to any of theexemplary processing operations of the processor unit 311 as describedabove. For example, the control unit of the NIC 2 can perform any of theexemplary processing operations illustrated in FIGS. 4 and 5A-5C.

The NIC 2 also includes a notification unit configured to output,external to the associated utility meter, notification of thedetermination of an anomalous event by the control unit of the NIC 2.According to an exemplary embodiment, the notification unit can beconstituted by the transceiver 9, antenna 11, and/or LED 16 of the NIC2. For example, if the control unit determines that an anomalous hasoccurred with respect to the NIC 2, the control unit can be configuredto automatically control the transceiver 9 to externally output a signalcontaining notification of the determined anomalous event to aneighboring node with which the NIC 2 is authorized to communicate. Thecontrol unit can be configured to generate the notification signal toinclude an alert indicator (e.g., a flag) that can be recognized by thereceiving node that the notification signal contains notification of adetected anomalous event. The NIC 2 can instruct the neighboring node toforward the notification signal to the communication station 120 of theutility provider and/or an access point 110 of the utility network 100,which can in turn forward the notification signal to the communicationstation 120. In addition to or as an alternative to the transceiver 9transmitting a signal to a neighboring node, the control unit of the NIC2 can control the notification unit to output a visual indication of thedetermined anomalous event. For example, the control unit can cause theLED 16 to display a representation of the determined anomalous eventaccording to a predetermined pattern of illuminating the LED 16. Thepattern of illumination can be associated with the type of the anomalousevent that was detected. In the exemplary embodiment of FIG. 2, one LED16 is illustrated. However, additional LEDs may be provided, and theLEDs may be single or multi-color.

The notification unit of the NIC 2 outputs notification of thedetermined anomalous event at the time that the anomalous event isdetermined to have occurred, to thereby provide real-time notificationof the determination of the anomalous event.

According to an exemplary embodiment, the threshold operatinginformation recorded in the memory unit 7 can specify a maximumthreshold value of a particular commodity that is to be consumed at thepremises associated with the NIC 2. For example, suppose that thethreshold operating information defined and recorded in the memory unit7 specifies a maximum daily threshold value of 40 kWh for consumption ofelectricity at the premises at which the NIC 2 is located. In thisexample, the control unit of the NIC 2 can determine whether ananomalous event has occurred with respect to the NIC 2, based on acomparison of the operation data generated by NIC 2 with the thresholdoperating information recorded in the memory unit 7. If an anomalousevent is determined to have occurred in the NIC 2, the control unitcauses the notification unit to output an appropriate notification ofthe determined anomalous event external to the meter with which the NIC2 is associated. For example, if the control unit of the NIC 2 isconfigured to monitor the amount of electricity consumed at theassociated premises on a daily basis, via interaction with the meterinterface 8 of the NIC 2, for example, suppose that the monitored amountof electricity consumption for the day is 45 kWh. The control unit ofthe NIC 2 then generates operation data indicating a daily consumptionvalue of 45 kWh. The control unit then compares the generated operationdata with the threshold operating information recorded in the memoryunit 7. In this example, the control unit will determine that thegenerated operation data indicates an anomalous event, because thegenerated operation data indicating 45 kWh exceeds the threshold valueof 40 kWh defined in the threshold operating information recorded in thememory unit 7 of the NIC 2. Accordingly, the control unit will generatea notification signal including data identifying the determinedanomalous event, and control the notification unit to output thenotification signal. For example, the control unit can control thenotification unit to transmit the notification signal to thecommunication station 120 via another node in the utility network 100,such as a neighboring meter node, an access point 110 and/or a relay140. When generating the notification signal, the control unit caninclude an alert message (e.g., a flag) that can be recognized by thenode receiving the notification signal so that the notification signalis promptly forwarded to the communication station 120.

According to another exemplary embodiment, the threshold operatinginformation can specify a maximum daily threshold value of a particularcommodity being consumed at the premises associated with the NIC 2during a predetermined time period. For example, suppose that thethreshold operating information recorded in the memory unit 7 of the NIC2 specifies a maximum threshold value of 1,800 kWh over a forty-five(45) day period. As described above, the control unit of the NIC 2records the operation data generated by the control unit in the memoryunit 7 at the time the operation data is generated. In this example, thecontrol unit can thus generate operation data indicating an accumulated,total value of consumption over the forty-five day period. Suppose, forexample, that at the conclusion of the forty-five day period, theaccumulated value of energy consumption at the premises associated withthe NIC 2 includes a total consumption value of 1,900 kWh. The controlunit of the NIC 2 is configured to compare the generated operation dataindicating a cumulative consumption value of 1,900 kWh during theforty-five day period with the threshold operating information defininga threshold maximum value of 1,800 kWh for a forty-five day period. Inthis example, the control unit of the NIC 2 will determine that ananomalous event has occurred, because the generated operation dataexceeds the threshold value defined in the threshold operatinginformation recorded in the memory unit 7 of the NIC 2. Based on thisdetermination, the control unit of the NIC 2 generates a notificationsignal indicating the detection of the anomalous event, and controls thenotification unit to transmit a notification signal to another node inthe utility network 100, such as a neighbor meter node, an access point110 and/or a relay 140, to forward the notification signal to thecommunication station 120.

In the above example in which the control unit of the NIC 2 comparesaccumulated operation data with threshold operating information defininga threshold maximum value over a predetermined period of time, thecontrol unit of the NIC 2 determined the occurrence of anomalous eventat the conclusion of the predetermined period of time. Alternatively,the control unit of the NIC 2 can be configured to compare the generatedoperation data on the basis of a sliding time window. For example, inthe above example in which the threshold operating information defines athreshold value of 1,800 kWh for a forty-five day period, the controlunit of the NIC 2 can be configured to continuously compare thegenerated operation data with a fractional amount of the threshold valuedefined in the threshold operating information based on the number ofdays that have elapsed in the period of time. In the above example inwhich the threshold operating information defines a threshold value of1,800 kWh over a forty-five day period, the average daily amount of thisthreshold value would be 40 kWh per day. Rather than wait to determinewhether an anomalous event has occurred at the conclusion of thepredetermined period of time, the control unit can be configured todetermine an anomalous event prior to the conclusion of thepredetermined period of time. For example, based on an average dailyconsumption amount of 40 kWh per day, the control unit can generateoperation data that includes a counter value indicating the number oftimes during the predetermined period of time that the daily monitoredconsumption value exceeds the average value of 40 kWh. The thresholdoperating information defined in the memory unit 7 can also include athreshold value representing an acceptable number of times that themonitored daily consumption value can exceed the average dailyconsumption value. For example, suppose that the threshold operatinginformation, in addition to defining a threshold value of 1,800 kWh fora forty-five day period, also defines a counter value of ten (10) thatrepresents an acceptable number of times that the monitored dailyconsumption value can exceed the average daily consumption value. Inthis example, the control unit can be configured to generate operationdata including a counter value representing the number of times that themonitored consumption value exceeds the average daily consumption value.For example, suppose at day three during the forty-five day period, thecontrol unit generates operation data indicating a consumption value of42 kWh for that day. The control unit will then, in turn, increment thecounter value that is included in the operation data recorded in thememory unit 7. Upon each increment of the counter value, the controlunit can be configured to compare the counter value defined in therecorded operation data with the threshold operating informationindicating the acceptable number of times that the monitored dailyconsumption value can exceed the average daily consumption value.Suppose, for example, at day twenty during the forty-five day period,the control unit increments the counter defined in the recordedoperation data to a value of eleven. Upon incrementing the counter valueto a value of eleven, the control unit will, in this example, determinethat an anomalous event has occurred in the NIC 2, based on thecomparison of the generated operation data with the threshold operatinginformation indicating the acceptable number of times that the monitoreddaily consumption value can exceed the average daily consumption value.Accordingly, in this example, the control unit will generate thenotification signal identifying the determination of the anomalous eventand control the notification unit to transmit the notification signal atday twenty of the forty-five day period, rather than at the conclusionof the forty-five day period.

The determination of an anomalous event on the basis of a sliding timewindow is not limited to the foregoing example of average dailyconsumption values. The control unit can determine the occurrence of ananomalous event for any type of threshold operating information inaccordance with a sliding time window. If the threshold operatinginformation defines an acceptable operating parameter over apredetermined period of time, the control unit of the NIC 2 can beconfigured to determine the occurrence of an anomalous event at thepoint in time that the operation data generated by the control unit doesnot comport with the acceptable operating parameters defined in thethreshold operating information, rather than wait to determine theoccurrence of the anomalous event at the conclusion of the predeterminedperiod of time. For example, suppose that the threshold operatinginformation recorded in the memory unit 7 indicates the number of timesthat a NIC 2 associated with a meter can receive an unsecuredcommunication from another meter node in the utility network 100. Asdescribed above, nodes in the utility network 100 communicate with eachother according to defined security protocols. The threshold operatinginformation recorded in the memory unit 7 of a NIC 2 can define theacceptable number of times that a NIC 2 can receive a communication fromanother node in the utility network 100 without the proper securitycredentials in a predetermined period of time. According to an exemplaryembodiment, the NIC 2 can transmit a communication failure message tothe node from which the NIC 2 received a communication without theproper security credentials. The threshold operating information definedin the memory unit 7 can include a threshold value indicating a maximumnumber of times that the NIC 2 can transmit a communication failuremessage to another node attempting to communicate with the NIC 2 duringa predetermined period of time. For example, the threshold operatinginformation defined in the memory unit 7 of the NIC 2 can include athreshold value of five communication failure messages transmitted inone day to another node which is attempting to communicate with the NIC2. In this example, the control unit of the NIC 2 increments the valueof a counter defined in operation data recorded in the memory unit 7each time the NIC 2 transmits a communication failure message to theother node. The threshold value defined in the threshold operationinformation can define an acceptable value, such that the thresholdvalue must be exceeded before there will be a detection of an anomalousevent. Alternatively, the control unit of the NIC 2 can be configured todetermine that an anomalous event has occurred when the value of theincremented counter is greater than or equal to the threshold valuedefined in the threshold operating information. Accordingly, in thisexample, when the incremented value of the counter representing thenumber of communication failure messages transmitted to the other nodein one day is equal to or greater than the threshold value defined inthe threshold operating information, the control unit will determinethat an anomalous event has occurred based on a comparison of thecounter value included in the recorded operation data with the thresholdoperating information recorded in the memory unit 7. Upon thisdetermination, the control unit is configured to generate a notificationsignal indicating the determination of the anomalous event, and controlthe notification unit to transmit the notification signal to anothernode distinct from the node that transmitted the unsecuredcommunications. For example, the NIC 2 can transmit the notificationsignal to a neighboring meter node, an access point 110, and/or a relay140, to forward the notification signal to the communication station120.

In the foregoing example, the threshold operating information defined athreshold value of the number of failure communication messages that canbe sent in a predetermined period of time. The present disclosure is notlimited to this example. For example, the threshold value defined in thethreshold operating information can include information defining thenumber of other nodes to which the node transmits a communicationfailure message in a predetermined period of time, the type of failures,the type of messages transmitted to the other nodes, etc.

According to an exemplary embodiment, when a node (e.g., meter 130) inthe utility network 100 communicates with other nodes in the utilitynetwork 100, the node can search for an optimal communication path to anaccess point, based on communication factors such as a path cost andlink cost to the access point 110. Factors involved in the path and linkcosts can include, for example, the number of hops from the node to anaccess point 110, the number of neighbor nodes with which another nodecommunicates, transmission efficiency, bit error rate and transmissionpower of the neighbor nodes, etc. When searching for an optimalcommunication path to an access point 110, a node builds a routingtable, which has registered therein the neighboring nodes with which thenode is authorized to communicate. The routing table of the node mayinclude a number of upstream nodes which the node may use to transmitcommunications to the access point 110, and a number of downstream nodesfrom which the node receives communications to forward on to the accesspoint 110. For example, suppose that a first node can function as aproxy or gateway node for a number of downstream nodes to transmitcommunications from the downstream node to an access point 110. In thisexample, the routing table of the first node will include routingregistration messages from each downstream node which has requested thefirst node to forward messages on to the access point 110. The thresholdoperating information defined in the NIC 2 constituting the first nodecan include a threshold value of un-registration messages received fromthe downstream nodes registered in the routing table of the NIC 2 whichtransmit an un-registration message to the NIC 2 during a predeterminedperiod of time. In this example, the control unit of the NIC 2 can beconfigured to increment a value of a counter each time that the NIC 2receives an un-registration message from a downstream node registered inthe routing table of the NIC 2, and generate operation data representingthe increased value of the counter. The control unit 2 can also beconfigured to compare the value of the counter represented in thegenerated operation data with the threshold value included in thethreshold operating information recorded in the memory unit, anddetermine that an anomalous event has occurred when the value of thecounter is greater than or equal to the threshold value included in thethreshold operating information recorded in the memory unit 7 of the NIC2. The control unit of the NIC 2 can generate a notification signalindicating the determination of the anomalous event

The threshold operating information defined in the memory unit 7 of theNIC 2 can indicate a maximum number of communications that the NIC 2 isexpected to receive from another node in the utility network 100 in apredetermined time period. For example, the threshold operatinginformation can indicate that the NIC 2 is not expected to receive morethan five communications from any one node in a given day. In thisexample, if the operation data generated by the NIC 2 that representsthe number of communications received by the NIC 2 does not comport withthe threshold operating information, the control unit of the NIC 2 willdetermine that an anomalous event has occurred. In this example, supposethat the NIC 2 has received a total of ten communications from aparticular node in the utility network 100 in one day. As such, theoperation data measured by the control of the NIC 2 in relation to thenumber of communications the NIC 2 has received from the other node doesnot comport with the threshold operating information recorded in thememory unit 7 of the NIC 2. Accordingly, based on a comparison of themeasured operation data pertaining to the number of communicationsreceived from the other node in a single day, the control unit willdetermine that an anomalous event has occurred with respect to thesituation that the NIC 2 received ten communications from another nodein a single day. Based on this determination, the control unit of theNIC 2 will cause the notification unit to output an appropriatenotification indicating that an anomalous event was detected withrespect to the node from which the NIC 2 received a total of tencommunications in a single day.

In accordance with an exemplary embodiment, the threshold operatinginformation defined in the memory unit 7 of the NIC 2 can indicate athreshold value for the number of synchronization packets which the NIC2 sends to another node in the utility network 100 within apredetermined period of time. For example, if the NIC 2 is rebooted orneeds to reset its synchronization pattern with another node in theutility network 100, the threshold operating information can define athreshold value for the number of synchronization attempts the NIC 2performs to establish synchronization with another node (e.g., a meternode 130, an access point 110, a relay 140, etc.) in the utility network100 and/or the number of synchronization packets the NIC 2 sends toanother node in the utility network 100. According to an exemplaryembodiment, when communicating with another node in the utility network100, the NIC 2 can transmit a time synchronization packet(s) to theother node to indicate to the other node a time period when the othernode should expect to receive information (e.g., operation data)transmitted from the NIC 2. Upon receiving the synchronization packet(s)from the NIC 2, the other node can operate in a reception mode duringthis period of time to receive the information transmitted from the NIC2. For example, suppose that a NIC 2 transmits a synchronizationpacket(s) to another node indicating that the NIC 2 will transmitinformation to the other node during a period from 2:00 pm to 2:10 pm.The other node will, upon receiving the synchronization packet(s) fromthe NIC 2, operate in a reception mode during this ten minute timeperiod. If the NIC 2 transmits a synchronization packet(s) to the othernode and the other node does not acknowledge receipt of thesynchronization packet, the NIC 2 can resend the synchronization packetto the other node. The threshold operating information defined in thememory unit 7 of the NIC 2 can therefore include a threshold valueindicating the number of times that the NIC 2 can expect to transmit asynchronization packet to the other node in a particular time period.

For example, the threshold operating information defined in the NIC 2can specify a threshold value of three for the number of unacknowledgedsynchronization packets transmitted to another node in the span of afifteen minute period. Suppose, for example, that during the span offifteen minutes, the NIC 2 transmits a synchronization packet to a firstnode in three separate increments, but these synchronization packets arenot acknowledged by the first node. Based on the threshold operatinginformation defined in the memory unit 7 specifying the maximum numberof unacknowledged synchronization packets during this period of time,the NIC 2 can then generate and transmit a signal to a second node inthe utility network 100 (i.e., a different node than the first node withwhich the NIC 2 was attempting to establish synchronization) to indicatethat the NIC 2 is having difficulty establishing synchronization withthe first node. The second node can, in turn, transmit the notificationtransmitted from the NIC 2 to the communication station 120 of theutility provider.

In accordance with an exemplary embodiment, the threshold operatinginformation defined in the memory unit 7 of the NIC 2 can also specify athreshold value for the frequency with which the NIC 2 must establishsynchronization with another node to communicate with the other node.For example, the threshold operating information defined in the memoryunit 7 of the NIC 2 can specify a maximum threshold value for how oftenthe NIC 2 is expected to establish synchronization with another node inthe utility network 100. Suppose, for example, that the thresholdoperating information defined in the memory unit 7 of the NIC 2indicates that the NIC 2 is expected to establish synchronization withanother node (e.g., a meter node 130, an access point 110, a relay 140,etc.) a maximum of three times per day. In this example, if the NIC 2must establish synchronization with the other node more than three timesin one day, then the NIC 2 can generate and transmit a notificationsignal to that same node or another node in the utility network 100(i.e., a different node than the node with which the NIC 2 wasattempting to establish synchronization) to indicate the abnormal amountof times the NIC 2 is having to establish synchronization with thatnode. The node receiving the notification signal from the NIC 2 can, inturn, transmit the notification transmitted from the NIC 2 to thecommunication station 120 of the utility provider.

In accordance with another exemplary embodiment, the threshold operatinginformation can specify maximum threshold values for various operatingparameters that are to be monitored in the NIC 2. For example, supposethat the threshold operating information specifies maximum thresholdvalues of voltage, current, switch recloser status and temperaturerecorded in an RTU equipped with an associated NIC 2. If the operationdata measured with respect to operating parameters of the RTU do notcomport with the threshold operating information recorded in the memoryunit 7 of the NIC 2, then the control unit of the NIC 2 will determinethat an anomalous event has occurred with respect to the operation datathat did not comport with the threshold operating information orsituational operation information.

In another example, suppose that the threshold operating informationspecifies the security credentials that are required for the NIC 2 to beable to communicate with another node in the utility network 100.Suppose also that the geographic area in which the NIC 2 is located isexperiencing an outage in the electrical distribution network. If poweris restored to the meter associated with the NIC 2 before power isrestored to any other node in the geographic area in which the outage isoccurring, the NIC 2 will likely be unable to communicate with any ofthe neighboring nodes. Based on the likely inability of the NIC 2 tocommunicate with any of the neighboring nodes, the control unit of theNIC 2 can be configured to determine that the security credentials ofthe NIC 2 are not trusted by the neighboring nodes, and therefore thecontrol unit may determine that the measured operation data relating tothe inability of the NIC 2 to communicate with the neighboring nodesdoes not comport with the threshold operating information defined in thememory unit 7. In this example, the measured operation data relating tothe inability of the NIC 2 to communicate with neighboring nodes is notprecisely directed to the same operational metric defined in thethreshold operating information. However, if the control unit 6 is notable to establish communication with the neighboring nodes and is notinformed of the specific reason for the inability to establishcommunication with the neighboring nodes, the control unit 6 can beconfigured to automatically determine that the security credentials ofthe NIC 2 or the security credentials of the neighboring nodes have beencompromised. Accordingly, based on this determination, the control unitof the NIC 2 can cause the notification unit to output notification ofthe determined anomalous event relating to the inability of the NIC 2 toestablish communication with one or more other nodes in the geographicarea.

In another exemplary embodiment, suppose that the threshold operatinginformation relates to distribution automation switching event counting.For example, suppose that the threshold operating information isdirected to a maximum threshold value of the number of switching eventsor commands that may be issued by an RTU installed at a distributiondevice of the distribution network. As described above, in adistribution automation system, various quantities such as voltage,current, switch status, temperature and oil level, for example, arerecorded in the field at the distribution transformers or feeder by anRTU. In this example, the control unit of the NIC 2 monitors the numberof switching events or commands that have been issued and checks againstthe measured voltage/phase changes. Chatter is caused when there isfaulty equipment (such as an RTU) that is changing its values constantlyand issuing switching commands without any real effect, and thusclogging the communication channel with inaccurate switches. The controlunit of the NIC 2 determines that there is no resulting voltage/phasechange in spite of the series of commands issued by the RTU. In thisexample, since the control unit of the NIC 2 measures the number of theswitching events or commands that have been issued by the RTU andcompares the measured number of switching events or commands with theactual number of switching events or commands based on the measuredvoltage/phase changes, the control unit of the NIC 2 can determine thatthe measured operation data from the RTU does not comport with theactual operation data measured by the control unit of the NIC 2.Accordingly, in this example, the control unit of the NIC 2 willdetermine that an anomalous event has occurred with respect to theoperation of the RTU and cause the notification unit to outputnotification of the anomalous event that was determined to have occurredwith respect to the RTU. Concerning the incorrect number of switchingcommands issued by the RTU, the control unit of the NIC 2 can flag thecommands issued by the RTU as chatter, and suppress issuance of thecommands from the RTU.

In exemplary embodiments described above, the control unit was describedas incrementing a counter value each time a predetermined conditionand/or event was determined to have occurred, and comparing theincremented counter value to a threshold value defined in the thresholdoperating information recorded in the memory unit 7 of the NIC 2.Alternatively, the control unit of the NIC 2 can initially set thecounter value to the threshold value indicated in the thresholdoperating information, and decrement the counter each time thepredetermined condition and/or event was determined to have occurred. Inthis alternative configuration, the control unit of the NIC 2 willdetermine that an anomalous event has occurred when the value of thecounter reaches zero. Accordingly, exemplary embodiments of the presentdisclosure provide that the control unit of the NIC 2 is configured toadjust (e.g., increment, decrement) the value of the counter each timethat the predetermined condition and/or event is determined to haveoccurred, and determine that an anomalous event has occurred when thethreshold value indicated in the threshold operating information hasbeen reached.

The foregoing examples of threshold operating information are intendedto illustrate different types of operating parameters of nodes that canbe monitored by the NIC 2 to detect whether an anomalous event hasoccurred with respect to utility meter 130 with which the NIC 2 isassociated in the utility network 100. The present disclosure is notlimited to the foregoing examples. The threshold operating informationdefined for any node to be monitored by a NIC 2 can be directed to anyconceivable operating parameter of a node that is desired to bemonitored by the NIC 2.

In exemplary embodiments described above, a utility meter 130 wasdescribed as constituting a node in the utility network 100 by beingassociated with a NIC 2. The present disclosure is not limited to thisembodiment. For example, one or more of the components of the NIC 2illustrated in FIG. 2 can be constituted in the utility meter 130, inaddition to or as an alternative to a utility meter 130 having a NIC 2associated with the utility meter 130. According to an exemplaryembodiment, components of the control unit of the NIC 2 (e.g., the CPU6, ASIC 5 and/or memory 7) can be constituted in a processing unit(e.g., computer processor) of the meter 130, and the above-describedoperating system and/or application programs of the NIC 2 can beinstalled in a non-volatile, computer-readable recording medium (memoryunit) of the processing unit of the utility meter 130. For example, whenthe utility meter 130 is manufactured and/or commissioned at aparticular premises, the above-described operating system and/orapplication programs of the NIC 2 can be installed in the memory unit ofthe utility meter 130. Similarly, the utility meter 130 can beconfigured to include a network interface such as the transceiver 9illustrated in FIG. 2 to enable the utility meter 130 to constitute anode in the utility network 100 and communicate with other nodes (e.g.,other utility meters 130, access point(s) 110, relay(s) 140, and/or thecommunication station 120 of the utility provider) in the utilitynetwork 100. Accordingly, as an alternative to being provided with a NIC2, a utility meter 130 can be configured to include the components andoperative functions of the NIC 2 in accordance with the above-describedexemplary embodiments. Therefore, a utility meter 130 including thecomponents and operative functions of the NIC 2 in accordance with anyof the above-described exemplary embodiments can constitute a node inthe utility network 100, since the utility meter 130 is enabled tocommunicate with other nodes in the utility network 100.

FIG. 8 illustrates an exemplary method 800 of operating a NIC 2 todetect anomalous events occurring in connection with at least one nodein the utility network 100. In this example, the NIC 2 is associatedwith a utility meter in the utility network 100 and constitutes a nodein the utility network 100. In step S810, threshold operatinginformation is recorded in the memory unit 7 of the NIC 2. It is to beunderstood that the exemplary method 800 illustrated in FIG. 8 is alsoapplicable to a method of operating a utility meter 130 constituting theoperative components and functions of a NIC 2 in accordance with theexemplary embodiments described above. The threshold operatinginformation includes data indicative of configured acceptable operatingparameters of the node in the utility network 100.

In optional step S820, threshold operating information can be receivedfrom at least one node in the utility network 100. For example, thethreshold operating information can be received from the communicationstation 120 of the utility provider via one or more intermediary nodes,such an access point 110, another utility meter 130 and/or a relay 140.The received threshold operating information includes configuredoperation data expected to occur in the NIC 2. The received thresholdoperating information is recorded in the memory unit 7 of the NIC 2 instep S820. In addition to or as an alternative to receiving thethreshold operating information, the threshold operating information canbe predefined in the memory unit 7 of the NIC 2. If the thresholdoperating information is received and recorded and/or predefined in thememory unit 7, the NIC 2 can receive updated and/or new thresholdoperating information from at least one node in the utility network 100,and appropriately record the updated and/or new threshold operatinginformation in the memory unit 7.

In step S830, the control unit of the NIC 2 monitors (e.g., measures,determines a counter value, etc.) operation data from at least one ofthe NIC 2 and the associated utility meter 130. In step S840, thecontrol unit of the NIC 2 compares the measured operation data with thethreshold operating information recorded in the memory unit 7.

In step S850, the control unit of the NIC 2 determines whether themeasured operation data constitutes an anomalous event based on thecomparison of the measured operation data with the threshold operatinginformation in step S840. For instance, in step S850, the control unitof the NIC 2 determines whether the measured operation data representsan acceptable operating condition for the associated meter and/or theNIC 2, based on the comparison in step S840.

If the control unit of the NIC 2 determines that an anomalous event hasoccurred with respect to the NIC 2 and/or the associated meter, then, instep S870, the control unit of the NIC 2 causes the notification unit ofthe NIC 2 to output, external to the associated meter, notification ofthe determined anomalous event.

On the other hand, if the control unit of the NIC 2 does not determinethat an anomalous event has occurred in step S850, the method returns tostep S830 in which the control unit of the NIC 2 measures new operationdata from the associated meter and/or the NIC 2. Alternatively, asillustrated by the dotted lines in FIG. 8, the control unit of the NIC 2can return to step S820 to wait for reception of new threshold operationinformation to be received from another node in the utility network 100.

In the exemplary method illustrated in FIG. 8, steps S840 and S850 caninclude any of the comparison and determination operations defined withrespect to the exemplary embodiments illustrated in FIGS. 4 and 5A-5C.In addition, the exemplary method illustrated in FIG. 8 can include anyof the features of the above-described exemplary embodiments.

Furthermore, another exemplary embodiment of the present disclosureprovides a computer-readable recording medium on which a computerprogram is recorded that causes the control unit of the NIC 2 to detectanomalous events occurring in connection with the NIC 2. With referenceto the exemplary embodiment illustrated in FIG. 2, the memory unit 7and/or ROM comprised in the CPU 6 can constitute a computer-readablerecording medium on which an operating system and/or applicationprograms of the NIC 2 can be recorded and executed by the control unit(e.g., CPU 6) of the NIC 2. The control unit of the NIC 2 is configuredto communicate with any of these computer-readable recording media andthus is communicatively connected to these computer-readable media. Theprogram recorded on the computer-readable recording medium can cause thecontrol unit of the NIC 2 to perform any of the operations of theexemplary embodiments described above.

XII. Exemplary Operations of Access Point

As described above, nodes in the utility network 100 can transmitcommunications to an access point 110 to be forwarded to thecommunication station 120 of the utility provider. An access point 110can be configured similarly to the constituent elements of the NIC 2illustrated in FIG. 2, and/or the constituent elements of thecommunication station 120 as illustrated in FIG. 3. For example, anaccess point can include a memory unit similar to the NIC 2 and/orcommunication station 120, as well as control unit similar to the NIC 2and/or communication station 120. The access point 110 also includes anetwork interface such as a transceiver to communicate via wired and/orwireless transmission mediums with the communication station 120 and thenodes downstream from the access point 110.

Similar to the functions of the communication station 120 and othernodes having an associated NIC 2, an access point 110 can also beconfigured to determine the occurrence of an anomalous event withrespect to one or more other nodes in the utility network 100.

For example, when a node downstream of the access point 110 intends toutilize an access point 110 as an interface between the node and thecommunication station 120, the node registers with the access point 110.The access point 110 maintains a routing table in which each downstreamnode registered with the access point 110 is represented. The accesspoint 110 continuously updates its routing table based on information itreceives from the nodes registered in its routing table. The accesspoint 110 can be configured to detect an anomalous event with respect toone or more downstream nodes if, for example, the routing table for thedownstream node(s) changes at a rate exceeding a rate defined inthreshold operating information recorded in the memory unit of theaccess point 110. In addition, the access point 110 can be configured todetect an anomalous with respect to one or more downstream nodes if theaccess point 110 receives a number of registration and/orun-registration messages from a downstream node that exceeds a thresholdvalue defined in threshold operating information recorded in the memoryunit of the access point 110. Similar to the above-described functionsof a NIC 2, the access point 110 compares information it receives fromdownstream nodes and can generate operation data representing thereceived information. The access point 110 can compare the generatedoperation data with threshold operation information defined and recordedin the memory unit of the access point 110. If the generated operationdata is indicative of an anomalous event based on the comparison of theoperation data with the threshold operating information recorded in thememory unit of the access point 110, the access point 110 can beconfigured to generate an appropriate notification signal and transmitthe notification signal to the communication station 120 to advise thecommunication station 120 of the detected anomalous event.

According to an exemplary embodiment, the access point 110 can also beconfigured to determine the occurrence of an anomalous event based onthe order of registration messages received from a downstream node. Forexample, the access point 110 can have threshold operating informationrecorded in its memory unit that specifies a predetermined order ofregistration messages that are supposed to be received from a downstreamnode when the downstream node attempts to register with the access point110. For example, if a downstream node transmits a registration messageto the access point 110 to register with the communication station 120,but the downstream node has not previously registered with the accesspoint 110, the access point 110 can determine that an anomalous eventhas occurred with respect to the registration procedure utilized by thedownstream node. As another example, the access point 110 can havethreshold operating information defined and recorded in its memory unitthat defines a threshold value of the number of downstream nodes thatare expected to register with the access point 110 in a particularperiod of time. If the access point 110 receives a number ofregistration requests from downstream nodes greater than or equal tothis threshold value, the control unit of the access point 110 candetermine the occurrence of an anomalous event with respect to thedownstream nodes, or possibly the occurrence of an anomalous event withrespect to another access point in the utility network 100. For example,if the threshold operating information recorded in the memory unit ofthe access point indicates a threshold value of one hundred newregistrations from downstream nodes in a month, and the access point 110receives one thousand new registrations from downstream nodes in a week,the reception of the new registration messages can be indicative of thefailure of another access point 110 in the utility network 100.

Upon determining the occurrence of an anomalous event with respect toone or more nodes in the utility network 100, the access point 110 canalso be configured to transmit the notification signal to thecommunication station 120 along with diagnostic information indicatingthe anomalous nature of the anomalous event. For example, the accesspoint 110 can transmit diagnostic information indicating that theanomalous event was detected at the access point 110, that the accesspoint 110 has confirmed the detection of the anomalous event based onits comparison of the information received from the downstream nodeswith the threshold operating information defined and recorded in theaccess point 110, and/or that the diagnostic information transmittedfrom the access point 110 characterizes the type of anomalous eventdetected.

The threshold operating information defined and recorded in the memoryunit of the access point 110 can include any of the aforementioned typesof threshold operating information discussed above with respect to thecommunication station 120 and/or NIC 2. Similarly, the access point 110can be configured to detect the occurrence of an anomalous event on asliding time window, as described above with respect to the functions ofa NIC 2.

In addition to the features of determining whether an anomalous eventhas occurred with respect to one or more nodes in the utility network100 with which an access point 110 can communicate on the basis ofthreshold operating information recorded in the memory unit of theaccess point 110, the access point 110 can also determine whether ananomalous event has occurred with respect to one or more nodes in theutility network 100 by comparing operation data received from one ormore nodes with (i) the threshold operating information defined for thenodes from which the operation data was received, and (ii) situationalinformation recorded in the memory unit of the access point, similar tothe exemplary features of the above-described communication station 120of the utility provider. For example, the access point 110 can receivesituational information including data indicative of configuredoperation data that is expected to be received from nodes in the utilitynetwork 100 during a predetermined period of time based on a conditionand/or event that is occurring during the predetermined period of time.The situational information that an access point 110 can receive and/orhave stored in its memory unit can correspond to any of theabove-described examples of situational information defined and recordedin the memory unit 314 of the communication station 120.

Exemplary embodiments of a communication station 120, an access point110 and a utility meter 130 have been described to illustrate how thesenodes in the utility network 100 can detect the occurrence of ananomalous event with respect to one or more nodes in the utility network100. It is to be understood that the structural components and operativefunctions of the various nodes in the utility network 100 for detectingthe occurrence of an anomalous event can be implemented in any of thevarious nodes in the utility network 100 in accordance with theexemplary embodiments described above. For example, the above-describedexemplary features of the communication station 120 for detecting ananomalous event with respect to downstream nodes can be implemented inan access point 110 and/or a utility meter 130 if such nodes possessappropriate processing components.

Combinations of the above-described exemplary embodiments, and otherembodiments not specifically described herein will be apparent to thoseskilled in the art upon reviewing the above description. The scope ofthe various exemplary embodiments includes various other applications inwhich the above systems, structures, programs and methods are used.

It will be appreciated by those skilled in the art that the exemplaryembodiments of the present disclosure can be embodied in other specificforms without departing from the spirit or essential character thereof.The presently disclosed embodiments are considered in all respects to beillustrative and not restrictive. The scope of the invention isindicated by the appended claims rather than the foregoing description,and all changes that come within the meaning and range of equivalentsthereof are indicated to be embraced therein.

What is claimed is:
 1. A utility network communication device configuredto monitor operating events occurring in connection with at least onenode in a utility network, the communication device comprising: a memoryunit having threshold operating information and situational informationdefined and recorded therein, the threshold operating informationincluding data indicative of configured acceptable operating parametersof nodes in the utility network based on respective locationalinformation of each of the nodes in the utility network, the locationalinformation of each one of the nodes respectively including uniqueinformation about that node, relative to each other one of the nodes inthe utility network, such that unique threshold operating information isrespectively defined for each node in the utility network based on theunique locational information respectively defined for that node, andthe situational information including data indicative of configuredoperation data expected to be received from nodes in the utility networkduring a predetermined time period based on at least one of a conditionand an event that is occurring during the predetermined time period; acommunication unit configured to receive operation data from nodes inthe utility network; a control unit configured to compare the operationdata received from a node in the utility network with (i) the thresholdoperating information defined for the node from which the operation datawas received and (ii) the situational information, and to record thereceived operation data in association with the situational informationin the memory unit based on the comparison of the received operationdata with (i) the threshold operating information defined for the nodeand (ii) the situational information.
 2. The communication deviceaccording to claim 1, wherein the control unit is configured to updateat least one of the threshold operating information defined for the nodeand the situational information recorded in the memory unit, based onthe comparison of the received operation data with (i) the thresholdoperating information defined for the node and (ii) the situationalinformation, when at least one of a) the received operation datadeviates a predetermined amount from (i) the threshold operatinginformation defined for the node or (ii) the situational information,and b) operating conditions in the utility network have changed.
 3. Thecommunication device according to claim 1, wherein the thresholdoperating information defined for a node in the utility network includesinformation defining at least one of: a maximum threshold value ofconsumption of a commodity in a predetermined time period; historicaloperating patterns of the node for which the threshold operatinginformation is defined; a connection state of the node to a distributionnetwork; load devices serviceable at the node; an excessive number ofremote connect/disconnects for the node in the utility network; anexcessive number of remote connect/disconnects for a plurality of nodesin a predetermined geographical area in which the node for which thethreshold operating information is defined, is located; an order ofrequested commands from other nodes in the utility network; apredetermined order of requested commands receivable from the node withrespect to a current operational state of the node; security credentialsof the node for communicating with other nodes in the utility network; amaximum number of communications to be received by the node from othernodes in the utility network in a predetermined time period;geographical coordinate information of the node; a number of other nodeslocated in a predetermined geographical area in which the node for whichthe threshold operating information is defined, is located; a number ofother nodes in the utility network being serviced by a common accesspoint as the node for which the threshold operating information isdefined; a number of other nodes in the utility network being servicedby a common distribution device of a distribution network as the nodefor which the threshold operating information is defined; operationalparameters of a distribution device of a distribution network arrangedin a distribution automation system; a connection/disconnection protocolof a predetermined number of remote terminal units in a predeterminedgeographic region; and acceptable operational parameters of a loaddevice serviceable at the node.
 4. The communication device according toclaim 1, wherein the locational information of a node includes at leastone of: geographic information about a premises at which the node islocated; connection information indicating whether the node is currentlyconnected to a distribution network to receive distribution of acommodity from the distribution network; residential usage informationof the premises at which the node is located; attribute information ofthe premises at which the node is located; premises comparisoninformation indicating a comparative size of the premises at which thenode is located relative to other premises at which other nodes in theutility network are located; load usage information indicating at leastone device serviceable at the node; functional information indicating afunctional use of the premises at which the node is located; periodicusage patterns indicating a historical consumption of a commodity duringa predetermined time period; financial information indicating a currentaccount status with a distribution network to which the node isconnected to receive distribution of a commodity distributed by thedistribution network; and construction information indicating at leastone of a construction date and a repair date of the premises at whichthe node is located.
 5. The communication device according to claim 1,wherein the situational information defines operation data expected tobe received during the predetermined time period based on at least oneof an event-based, operational-based, seasonal-based and weather-basedcondition occurring at the predetermined time period.
 6. Thecommunication device according to claim 5, wherein the situationalinformation includes an adjustment value for operational parametersdefined in the threshold operating information for a node based on theat least one of the event-based, operational-based, seasonal-based andweather-based condition occurring at the predetermined time period. 7.The communication device according to claim 1, wherein the at least onenode is a utility network interface device associated with a utilitymeter.
 8. The communication device according to claim 1, wherein thecontrol unit is configured to: compare the operation data received froma node with the threshold operating information defined for the nodefrom which the operation data was received; determine whether thereceived operation data represents an acceptable operating conditionbased on the comparison of the received operation data with thethreshold operating information; compare the received operation datawith the situational information, if the control unit determines thatthe received operation data represents an acceptable operating conditionbased on the comparison of the received operation data with thethreshold operating information; determine whether the receivedoperation data represents operation data that is expected to be receivedbased on the comparison of the received operation data with thesituational information; determine that the received operation datarepresents an anomalous event, if the control unit determines that thereceived operation data does not represent expected operation data basedon the comparison of the received operation data with the thresholdoperating information; determine whether acceptable operating parametersincluded in the threshold operating information defined for the node arealtered by the situational information, if the control unit determinesthat the received operation data does not represent an acceptableoperating condition based on the comparison of the received operationdata with the threshold operating information; determine that thereceived operation data represents an anomalous event, if the controlunit determines that the acceptable operating parameters included in thethreshold operating information defined for the node are not altered bythe situational information; compare the received operation data withthe situational information, if the control unit determines that theacceptable operating parameters included in the threshold operatinginformation defined for the node are altered by the situationalinformation; determine whether the received operation data representsoperation data that is expected to be received based on the comparisonof the received operation data with the situational information, if thecontrol unit determines that the acceptable operating parametersincluded in the threshold operating information defined for the node arealtered by the situational information; and determine that the receivedoperation data represents an anomalous event, if the control unitdetermines that the received operation data does not represent expectedoperation data based on the comparison of the received operation datawith the threshold operating information, and if the control unitdetermines that the acceptable operating parameters included in thethreshold operating information defined for the node are altered by thesituational information.
 9. The communication device according to claim8, wherein the control unit is configured to wait for new operation datato be received if the control unit does not determine that the comparedoperation data represents an anomalous event.
 10. The communicationdevice according to claim 1, wherein the control unit is configured to:compare the received operation data with the situational information;determine whether the received operation data represents operation datathat is expected to be received based on the comparison of the receivedoperation data with the situational information; compare the receivedoperation data with the threshold operating information defined for thenode, if the control unit determines that the received operation datarepresents expected operation data based on the comparison of thereceived operation data with the situational information; determinewhether the received operation data represents an acceptable operatingparameter based on the comparison of the received operation data withthe threshold operating information; determine that the receivedoperation data represents an anomalous event, if the control unit doesnot determine that the received operation data represents an acceptableoperating parameter based on the comparison of the received operationdata with the threshold operating information; and determine that thereceived operation data represents an anomalous event, if the controlunit determines that the received operation data does not representexpected operation data based on the comparison of the receivedoperation data with the threshold operating information.
 11. Thecommunication device according to claim 10, wherein the control unit isconfigured to wait for new operation data to be received if the controlunit does not determine that the compared operation data represents ananomalous event.
 12. The communication device according to claim 1,wherein the control unit is configured to: compare the receivedoperation data with the threshold operation defined for the node;compare the received operation data with the situational information;determine whether the received operation data represents an acceptableoperating parameter based on the comparison of the received operationdata with the threshold operating information; determine whether thereceived operation data represents operation data that is expected to bereceived based on the comparison of the received operation data with thesituational information; and determine that the received operation datarepresents an anomalous event, if the control unit determines that atleast one of (i) the received operation data does not represent anacceptable operating parameter based on the comparison of the receivedoperation data with the threshold operating information, and (ii) thereceived operation data does not represent expected operation data basedon the comparison of the received operation data with the situationalinformation.
 13. The communication device according to claim 12, whereinthe control unit is configured to wait for new operation data to bereceived if the control unit does not determine that the comparedoperation data represents an anomalous event.
 14. The communicationdevice according to claim 1, wherein the notification unit is configuredto output the notification of the anomalous event at the time thecontrol unit determines that the anomalous event has occurred.
 15. Thecommunication device according to claim 1, wherein the communicationdevice includes a user interface configured to receive a modification ofat least one of the threshold operating information and the situationalinformation recorded in the memory unit.
 16. The communication deviceaccording to claim 1, wherein the at least one node is selected from thegroup consisting of: a utility network interface device associated witha meter in the utility network, an access point in the utility network,a remote terminal unit equipped with a utility network interface device,a distribution device of a distribution network, and a terminal of adistribution automation system equipped with a utility network interfacedevice.
 17. A method of operating a utility network communication deviceto monitor operating events occurring in connection with at least onenode in a utility network, the method comprising: defining, in thecommunication device, threshold operating information for nodes in theutility network, the threshold operating information including dataindicative of configured acceptable operating parameters of each of thenodes in the utility network based on respective locational informationof the nodes in the utility network, the locational information of eachone of the nodes respectively including unique information about thatnode, relative to each other one of the nodes in the utility network,such that unique threshold operating information is respectively definedfor each node in the utility network based on the unique locationalinformation respectively defined for that node; defining, in thecommunication device, situational information for the nodes in theutility network, the situational information including data indicativeof configured operation data expected to be received from nodes in theutility network during a predetermined time period, based on at leastone of a condition and an event that is occurring during thepredetermined time period; recording the defined threshold operatinginformation and situational information in a memory unit of thecommunication device; receiving operation data from at least one node inthe utility network; comparing, in a processing unit of thecommunication device, the received operation data with (i) the thresholdoperating information and (ii) the situational information which arerespectively defined for the at least one node from which the operatingdata was received; and recording the operation data received from the atleast node in association with the recorded situational information inthe memory unit of the communication device, based on the comparison ofthe received operation data with (i) the threshold operating informationdefined for the at least one node and (ii) the situational information.18. The method according to claim 17, comprising: updating, in theprocessing unit of the communication device, at least one of thethreshold operating information defined for the at least one node andthe situational information recorded in the memory unit, based on thecomparison of the received operation data with (i) the thresholdoperating information defined for the node and (ii) the situationalinformation, when at least one of a) the received operation datadeviates a predetermined amount from (i) the threshold operatinginformation defined for the at least one node or (ii) the situationalinformation, and b) operating conditions in the utility network havechanged.
 19. A non-transitory computer-readable recording medium havinga computer program recorded thereon that causes a control unit of autility network communication device communicatively connected to thecomputer-readable recording medium to monitor operating events occurringin connection with at least one node in a utility network, the programcausing the control unit of the communication device to executeoperations comprising: defining threshold operating information fornodes in the utility network, the threshold operating informationincluding data indicative of configured acceptable operating parametersof each of the nodes in the utility network based on respectivelocational information of the nodes in the utility network, thelocational information of each one of the nodes respectively includingunique information about that node, relative to each other one of thenodes in the utility network, such that unique threshold operatinginformation is respectively defined for each node in the utility networkbased on the unique locational information respectively defined for thatnode; defining situational information for the nodes in the utilitynetwork, the situational information including data indicative ofconfigured operation data expected to be received from nodes in theutility network during a predetermined time period, based on at leastone of a condition and an event that is occurring during thepredetermined time period; recording the defined threshold operatinginformation and situational information in a memory unit of thecommunication device; receiving operation data from at least one node inthe utility network; comparing the received operation data with (i) thethreshold operating information and (ii) the situational informationwhich are respectively defined for the at least one node from which theoperating data was received; and recording the operation data receivedfrom the at least node in association with the recorded situationalinformation in the memory unit of the communication device, based on thecomparison of the received operation data with (i) the thresholdoperating information and (ii) the situational information.
 20. Thenon-transitory computer-readable recording medium according to claim 19,wherein the program causes the control unit of the communication deviceto execute an operation comprising: updating the at least one of thethreshold operating information defined for the at least one node andthe situational information recorded in the memory unit, based on thecomparison of the received operation data with (i) the thresholdoperating information defined for the node and (ii) the situationalinformation, when at least one of a) the received operation datadeviates a predetermined amount from (i) the threshold operatinginformation defined for the at least one node or (ii) the situationalinformation, and b) operating conditions in the utility network havechanged.